Linux Tips

How do I who modified a critical file and when?

- by John Britto - Leave a Comment - 1 min read
Quick Linux Tip #8:

Try: sudo auditctl -w /etc/passwd -p wa -k passwd_changes

Info: auditd is Linux's audit framework. auditctl sets up a watch on a file. You can then use ausearch later to query those logs.

Examples:

  • $ sudo auditctl -w /etc/shadow -p rwxa -k shadow_access
  • $ sudo ausearch -k passwd_changes -ts today
  • $ sudo aureport --file --summary

Note: Requires the auditd service. auditctl commands run silently and log events in the background. Use ausearch -k <key> later to inspect the generated logs when a file is changed.




LinuxTeck.com 
linuxteck@ubuntu:~$ sudo auditctl -w /etc/passwd -p wa -k passwd_changes

linuxteck@ubuntu:~$ sudo ausearch -k passwd_changes -ts today

time->Thu Jun 26 15:23:45 2026
type=SYSCALL msg=audit(1234567890.123:1001): arch=c000003e syscall=257 success=yes
exit=3 a0=ffffffff9c a1=7ffe1234abcd a2=241 a3=1a4 items=2 ppid=1234 pid=5678 auid=1000
uid=0 gid=0 comm="vim" exe="/usr/bin/vim"
type=PATH msg=audit(1234567890.123:1001): item=1 name="/etc/passwd" nametype=NORMAL

linuxteck@ubuntu:~$

PREVIOUS ARTICLE Quick Linux Tip #07: How do I speed up processing many files using all CPU cores? NEXT ARTICLE Quick Linux Tip #09: How do I see all processes with their container and resource limits?
About John Britto

John Britto Founder & Chief-Editor @LinuxTeck. A Computer Geek and Linux Intellectual having more than 20+ years of experience in Linux and Open Source technologies.

View all posts by John Britto →

Leave a Reply

Your email address will not be published.