SOLVED
Home

Linux File Change Tracking

Highlighted
jagadish .D
New Contributor

Linux File Change Tracking

 

 Hi,

 

I am working one of the customer enterprise environment azure cloud automation tasks. From azure perspective past couple of days working and trying to setup alert Management in OMS. We are using log search query to validate initially and then create relevant alerts. I am able to see some issues in Linux configuration file tracking . I enabled counter for Linux file tracking as per the screenshot and manually tested the query in log search either particular file or computer based, i can able to see the modified file details in output report. But my customer want to monitor and track all the configuration file changes.  So i tried to set below mentioned query with particular path with file extension it's not working. i am not sure which operator to use for here.

Could you please someone help me to resolve the issue. it will be very helpful for me and everyone. Thanks for advance and i am expecting good solution.

 

image.png

 planning to track : /etc/*.conf

query not working :

1) ConfigurationChange | where FileSystemPath =~ "/etc/*.conf"

2) ConfigurationChange | where ( ConfigChangeType == "Files" ) | where ( ChangeCategory == "Modified" ) | where FileSystemPath ??? "/etc/*.conf" - choosing operator

 

Thanks

Jags

 

 

 

 

5 Replies
Solution

Re: Linux File Change Tracking

Hi You will have to use string operators: https://docs.loganalytics.io/docs/Language-Reference/Scalar-operators/String-operators You can use matches regex but that might be not easy to solve if you do not know regex.

ConfigurationChange | where FileSystemPath startswith "/etc/" and FileSystemPath endswith ".conf" 

 

This should probably will allow you to scope to those specific files

Re: Linux File Change Tracking

Hi Stainslav,

 

Thanks for providing information.

if i use your query i can able to get .conf file changes. But it's collecting from entire path available directory files(/etc/other directory). But we are looking the file changes till next directory, not other directory (/etc/dir1/dir2/dir3/dir4/files).  it means (/etc/dir1/).

Let me know any solution available on this.

 

Thanks

 

Jagadish

Re: Linux File Change Tracking

Hi

I am not sure I understand what you are saying. Can you provide more details?

Re: Linux File Change Tracking

Hi Stainslav,

 

Apologies for misunderstanding.

 

I need to monitor the file changes only to next level of directory, which are in etc.  For example:  /etc/(azure)*.conf  - any modification done in azure.conf, alert need to be triggered.

 

Query should not pick any other directories apart from /etc/.

 

Thanks,

Jagadish

 

Thanks

Re: Linux File Change Tracking

Hi

I am still not sure if I get the scenario right but let me know if this works:

 

let test1 = datatable(Path:string)
[
    "/etc/auzre.conf",
    "/etc/azure/azure.conf",
    "/etc/bla/bla.conf",
    "/etc/bla/sadasd/bla.conf"
];
test1 | where Path matches regex "^/etc/([^/]+)$"
Related Conversations
Track Changes
Saad Moreea  in  Excel  on
0 Replies
FindTime becomes Find a time in Office 365
Darrell Webster  in  Change Alerts  on
76 Replies
Issues changing channel name - OneDrive folder
Darian Miller  in  Microsoft Teams  on
10 Replies
Powershell ISE for Linux?
Brian Barton  in  Windows PowerShell  on
3 Replies