I'm researching the best way to monitor both when a file was last modified
and by whom. The OSF/1 Audit subsystem will make a nice little trail of
crumbs for file opens and file closes, but as far as I can tell, there is no
way to distinguish between the reads and the writes.
My problem is that we occasionally discover that a file (e.g. tnsnames.ora
or hosts.equiv) has been modified, but we don't know by whom. If we could
log the RUID and EUID, we could know that it was changed by DBA #424 at 2:42
AM who su-ed to oracle at 2:41 AM.
Third party products are an option, and of course, I will summarize in
painful detail.
Harold
MCI WorldCom Systems Administrator
Received on Tue Jun 15 1999 - 14:01:44 NZST