![](/images/new-backgrounds/1308409/308409323x1.webp)
Templates and Alerts
Modification of Files/Directories Template
Table | File Being Modified Alert Properties (Continued) |
| |||
|
|
|
|
|
|
| Response | Alert | Alert |
|
|
| Program | Field | Alert Value/Format | Description | |
| Field | ||||
| Argument | Type |
|
| |
|
|
|
| ||
|
|
|
|
|
|
| argv[8] | Details | String | “User with uid<uid> <performed action on | Detailed alert |
|
|
|
| the file> <full pathname> (type=<type>, | description |
|
|
|
| inode=<inode>, device=<device>) when |
|
|
|
|
| executing |
|
|
|
|
| <program>(type=<type>,inode=<inode>,devi |
|
|
|
|
| ce=<device>), invoked as follows: |
|
|
|
|
| <argv[0]><argv[1]>..., as process with pid |
|
|
|
|
| <pid> and ppid <ppid> and running with |
|
|
|
|
| effective uid=<euid> and with effective |
|
|
|
|
| gid=<egid>. |
|
|
|
|
| where <performed action on the file> is set |
|
|
|
|
| to one of the following: |
|
|
|
|
| "changed the owner of" |
|
|
|
|
| "changed the permission of" |
|
|
|
|
| "opened for modification/truncation" |
|
|
|
|
| "renamed the file" |
|
|
|
|
| "created the file (and overwrote any existing |
|
|
|
|
| file) named" |
|
|
|
|
| "truncated the file" |
|
|
|
|
| "created as a hard link" |
|
|
|
|
| "created as a symbolic link" |
|
|
|
|
| "created the directory" |
|
|
|
|
| "created the file" |
|
|
|
|
| "created the character special file" |
|
|
|
|
| "created the block special file" |
|
|
|
|
| “created the pipe (fifo) file” |
|
|
|
|
| "deleted the file" |
|
|
|
|
| "deleted the directory" |
|
|
|
|
| "performed system call <#> on the file" |
|
|
|
|
|
|
|
| argv[9] | Local | Integer | <secs> | Local time in |
|
| Time |
|
| number of seconds |
|
|
|
|
| since epoch when |
|
|
|
|
| file is modified. |
|
|
|
|
|
|
150 | Appendix A |