Como eu interpreto o resumo da mudança aide.log

Question

Na seção Arquivos alterados de /var/log/aide/aide.log, há prefixos em cada linha que começam com f ou d. Estes significam quais aspectos do arquivo foram alterados, mas não consigo rastrear o que eles significam. (Obviamente eu poderia olhar os dados detalhados para o arquivo mais abaixo no arquivo de log, mas uma referência definitiva para as linhas de resumo é importante para o grepping.)

Aqui estão alguns exemplos:

f >.p.. mci.CA. .: /etc/passwd-
d =.... mc.. .. .: /bin
f =.... mci.C.. .: /bin/ip
d =.... mc.n A. .: /u1/home

    

Answer 1

Isso está detalhado na página de manual aide.conf , reproduzida aqui para ser completa e é uma atributo configurável dos relatórios gerados:

summarize_changes

Whether to summarize changes in the added, removed and changed files sections of the report or not. Valid values are yes,true,no and false. The default is not to summarize the changes.

The general format is like the string YlZbpugamcinCAXS, where Y is replaced by the file-type (f for a regular file, d for a directory, L for a symbolic link, D for a character device, B for a block device, F for a FIFO, s for a unix socket and ? otherwise).

The Z is replaced as follows: A = means that the size has not changed, a < reports a shrinked size and a > reports a grown size.

The other letters in the string are the actual letters that will be output if the associated attribute for the item has been changed or a "." for no change, a "+" if the attribute has been added, a "-" if it has been removed, a ":" if the attribute is listed in ignore_list or a " " if the attribute has not been checked. The exceptions to this are: (1) a newly created file replaces each letter with a "+", and (2) a removed file replaces each letter with a "-".

The attribute that is associated with each letter is as follows:

• A l means that the link name has changed.
• A b means that the block count has changed.
• A p means that the permissions have changed.
• An u means that the uid has changed.
• A g means that the gid has changed.
• An a means that the access time has changed.
• A m means that the modification time has changed.
• A c means that the change time has changed.
• An i means that the inode has changed.
• A n means that the link count has changed.
• A C means that one or more checksums have changed.
• A A means that the access control list has changed.
• A X means that the extended attributes have changed.
• A S means that the SELinux attributes have changed.