История изменений
Исправление
getup,
(текущая версия)
:
add a watch to the file /etc/passwd to register write and read events
# grep passwd /etc/audit/audit.rules
-w /etc/passwd -p rw
query for the events happend to the watched file today
# ausearch -f /etc/passwd -i -ts today
Исходная версия
getup,
:
add a watch to the file /etc/passwd to register write and read events
$ /etc/audit/audit.rules
-w /etc/passwd -p rw
query for the events happend to the watched file today
$ ausearch -f /etc/passwd -i -ts today