Linux Operating System (MOSC)

MOSC Banner

Most effective method to monitor directory for deleted files

edited Apr 10, 2024 6:01AM in Linux Operating System (MOSC) 6 commentsAnswered

I am running Oracle Linux 8.9 and trying to figure out the best method to monitor an important directory for file deletions. We do have Datadog and Solarwinds but apparently neither are good at detecting file deletions on Linux. Don't understand it but anyways I am tasked with figuring out how to monitor on file deletion events. I came across auditd which appears to be the right path to go down, let me know if there is a better alternative. So I created the file_delete.rules file in /etc/audit/rules.d with the content

-w <directory_I_am_monitoring> -p wa -k file_deletions

Howdy, Stranger!

Log In

To view full details, sign in to My Oracle Support Community.

Register

Don't have a My Oracle Support Community account? Click here to get started.

Category Leaderboard

Top contributors this month

New to My Oracle Support Community? Visit our Welcome Center

MOSC Help Center