How to log event on a directory (deletion)

Question

I have a folder on my RHEL 9 server that gets deleted every few days, but I don’t know which process or user is responsible.

I’d like to log all events related to this folder, particularly deletions.

I came across a tool called auditd, which seems like it could help, but I'm not sure how to configure it to monitor this specific folder.

Is auditd the best option for this task, or is there a better tool or script I could use to track and log deletions?

Is this enough?

auditctl -w /path/to/myfolder -p rwa -k rule_watch_folder

Answer 1

auditd

For your use case for detecting and logging file deletions on RHEL, auditd is the right choice, it is robust, already available, and secure.

Add a watch rule:

sudo auditctl -w /path/to/myfolder/ -p wa -k folder_monitor

• -w - Watch path

• -p wa - Monitor only write and attribute changes, includes deletions

• -k - folder_monitor` - identify events in logs

• Monitor/audit file delete on Linux

• How to use auditd to monitor a file deletion in Linux?

• Ensure auditd Collects File Deletion Events by User

• 7.5. Defining Audit Rules

• Adding multiple watch rules on same path

• What is the correct way to generate /etc/audit/audit.rules on Centos7?

• auditd(8) - Linux man page

Autitd produces logs, syslog and journald collect them

• Auditd, Syslog and Journald

Make the rule persistent and restart auditd.

inotifywait

If you prefer something simpler, you could use inotifywait but it is less robust.

• How to use inotifywait to watch a directory for creation of files of a specific extension

• How to use inotifywait to wait till a file is created and is written content with timeout

• inotifywait(1) - Linux man page

auditbeat

There is also auditbeat, it's more flexible and integrates with ELK stack, but heavier and not default on RHEL.

• github | beats/auditbeat/auditbeat.yml

• Use Auditbeat to collect system audit data and monitor file changes

Just try and test all three and decide for yourself which one works best for you.