Advertencia
Este documento es privado y es de uso exclusivo de sus autores y de SKINA TECH. Cualquier uso sin una autorización escrita es contra le ley de derechos de autor y de propiedad intelectual, y será motivo de una acción legal.
iWatch es un frontend de inotifyiwatch que es a un programa de monitoreo en tiempo real del del sistema de archivos. Su proposito es monitorear cualquier cambio en un directorio especifico o archivo y enviar un email inmediatamente despues del cambio. Hay usos particulares como para estos archivos en especial /etc/passwd,/etc/shadow or directory /bin o monitorear la actividad del directorio root.
Esta hecho en perl
Necesita
Linux kernel >= 2.6.13
Algunas librerias de perl para el manejo del sistema
Los siguientes paquetes:
Linux::Inotify2
Linux::Event
Mail::Sendmail
XML::Simple.
http://inotify-tools.sourceforge.net/ –
Centos: yum install inotify-tools y luego iwatch
Se puede ejecutar de dos formas
Example of the command line mode:
In the command line mode iWatch has following options:
Usage:
iwatch [-c command] [-e event[,event[,..]]] [-h|–help] [-m <email address>]
[-r] [-r] [-s <on|off>] [-t filter] [-v] [–version] [-x exception] <target>
Target is the directory or file you want to monitor.
-c command
You can specify a command to be executed if an event occurs. And you can use
following special string format in the command:
| %f Full path of the filename that gets an event | |
| %p Program name (iWatch) | |
| %v Version number |
-e event [,event[,..]]
Specify a list of events you want to watch. Following are the possible events you
can use:
| access | : file was modified | |
| modify | : file was modified | |
| attrib | : file attributes changed | |
| close_write | : file closed, after being opened in writeable mode | |
| close_write | : file closed, after being opened in read-only mode | |
| close | : file closed, regardless of read/write mode | |
| open | : file was opened | |
| moved_from | : File was moved away from. | |
| moved_to | : File was moved to. | |
| move | : a file/dir within watched directory was moved | |
| create | : a file was created within watched director | |
| delete | : a file was deleted within watched directory | |
| delete_self | : the watched file was deleted | |
| unmount | : file system on which watched file exists was unmounted | |
| q_overflow | : Event queued overflowed | |
| ignored | : File was ignored | |
| isdir | : event occurred against dir | |
| oneshot | : only send event once | |
| all_events | : All events | |
| default | : close_write, create, delete, move, delete_self and move_self. |
-h, –help
Print this help.
-m <email address>
Specify the contact point's email address. Without this option, iwatch will not send
any email notification. -r Recursivity of the watched directory.
-s <on|off>
Enable or disable reports to the syslog (default is off/disabled)
-t <filter string>
Specify a filter string (regex) to compare with the filename or directory name. It will
report events only if the file/directory name matchs the filter string. It is useful if you
watch a file like /etc/passwd or /etc/shadow. Instead watching this single file, just
watch the /etc directory with filter=“passwd|shadow”, because if you watch only the
passwd/shadow file, the watcher will be deleted after one change of this file, and you
will not get another notifications. This is caused by the application that changes
passwd or shadow (e.g. passwd or chfn), they don't change the files directly, but
create a new file and move it to passwd or shadow file, this will remove the inode and
therefore the watcher.
-v verbose mode.
–version
Print the version number.
-x exception
Specify the file or directory which should not be watched.
-X <regex string as exception>
Specify a regex string as exception
With this configuration, iwatch will monitor a single directory /var/www/localhost/htdocs withouth it's sub directories, and any notification will be sent to the contact point webmaster@localhost. But it will monitor the whole directory tree of /etc/apache2, including any sub directories created later after the IWatch is started. You can use also exception here if you don't want to get notification for a file or subdirectory inside the monitored directory.
| <config> <guard email=“myadmin@localhost” name=“IWatch”></guard> <watchlist> <title>Public Website</title> <contactpoint email=“webmaster@localhost” name=“Web Master”/> <path type=“single”>/var/www/localhost/htdocs</path> <path type=“single” syslog=“on”>/var/www/localhost/htdocs/About</path> <path type=“recursive”>/var/www/localhost/htdocs/Photos</path> </watchlist> <watchlist> <title>Operating System</title> <contactpoint email=“admin@localhost” name=“Administrator”/> <path type=“recursive”>/etc/apache2</path> <path type=“single”>/etc/passwd</path> <path type=“recursive”>/etc/mail</path> <path type=“exception”>/etc/mail/statistics</path> <path type=“single” filter=“shadow | passwd”>/etc</path> </watchlist> <watchlist> <title>Only Test</title> <contactpoint email=“root@localhost” name=“Administrator”/> <path type=“single” alert=“off” exec=“(w;ps -ef) | mail -s %f root@localhost”>/tmp/dir1</path> <path type=“single” events=“access,close” alert=“off” exec=“(w;ps -ef) | mail -s %f root@localhost”>/tmp/dir2</path> <path type=“single” events=“default,access” alert=“off” exec=“(w;ps -ef) | mail -s '%f is accessed' root@localhost”>/tmp/dir3</path> <path type=“single” events=“all_events” alert=“off”>/tmp/dir4</path> </watchlist> </config> |
-
FIN