Sample Header Ad - 728x90

I would like to audit an Ubuntu server to get a list of all files executed and all files read by the system

-2 votes
1 answer
172 views
I want to be able to instrument and analyze at a prebuilt server and get a list of every file read. I would also like to determine which of those files were read by the kernel to execute a program, load a library or just read by an application. I thought it would be simple. SELinux by default deny, and in permissive mode, it logs everything. So, install it with no rules and run it in permissive mode and everything should be logged. Note this question is related to [this one on Security SE](https://security.stackexchange.com/q/239436/281475) as I am experiencing something similar to that poster. Then there is the issue that running under SELinux or any of the other auditing packages would introduce substantial load and possibly change the behavior of the system under observation.
Asked by kkron (105 rep)
Oct 6, 2023, 12:21 AM
Last activity: Oct 14, 2024, 07:44 PM