Link to home
Create AccountLog in
Avatar of CSIA AN
CSIA ANFlag for Andorra

asked on

show diff on audited files after editition AIX

We have enabled  audit on files insode AIX systems and it's working as expected. For example, if you edit and change /etc/myfile.conf with VI, a record is shown on audit logs:

S_ENVIRON_WRITE root     root     Thu Feb 11 10:59:01 2016 OK          vi
         fichero audit object write event detected /etc/myfile.conf

But, the question:
 Is possible to audit, using auditbin,  the diff with original and the changed /etc/myfile.conf file?

If I remember well, auditd on Linux can do this.

Thanks.
ASKER CERTIFIED SOLUTION
Avatar of woolmilkporc
woolmilkporc
Flag of Germany image

Link to home
membership
Create a free account to see this answer
Signing up is free and takes 30 seconds. No credit card required.
See answer
Avatar of CSIA AN

ASKER

Thanks WMP!