filesystems - Monitor/audit file delete on Linux -

one of .beam files of 1 of application deps beingness deleted , not sure what/how.

is there way monitor or audit file see happens when deleted?

i'm using redhat distro.

yes, can utilize audit daemon. did't linux distro. reddish hat based systems contain auditd, , can utilize auditctl add together rules.

to watch directory recursively changes:

auditctl -w /usr/local/someapp/ -p wa

to watch scheme calls made programme pid of 2021:

auditctl -a exit,always -s -f pid=2021

check man page auditctl.

results logged /var/log/audit/audit.log

to ensure it's running.

/etc/init.d/auditd status

for more thorough approach, utilize tripwire or ossec, they're geared more toward intrusion detection.

linux filesystems

Five