Article 5QX59 How can I instruct Tripwire to detect files modified by particular user(s)?

How can I instruct Tripwire to detect files modified by particular user(s)?

by
RDarkfire
from LinuxQuestions.org on (#5QX59)
I have setup Tripwire on a web server, and it works with a default configuration loadout. I need to make one modification to the policy and I can't figure out how to do it -- how do I tell the Tripwire policy to listen for modifications on certain files/directories by particular users? More specifically -- how do I tell it to ignore modifications by "the system/application/whatever user" but listen for modifications by actual users? These are log files.

Said another way, using Tripwire-specific vernacular -- how do I use the GROWING variable, but also include the ability to check whether certain users have modified the file or not?

Hope this is clear enough -- thanks.latest?d=yIl2AUoC8zA latest?i=mv7PonpvnqI:GeZFhspm9ng:F7zBnMy latest?i=mv7PonpvnqI:GeZFhspm9ng:V_sGLiP latest?d=qj6IDK7rITs latest?i=mv7PonpvnqI:GeZFhspm9ng:gIN9vFwmv7PonpvnqI
External Content
Source RSS or Atom Feed
Feed Location https://feeds.feedburner.com/linuxquestions/latest
Feed Title LinuxQuestions.org
Feed Link https://www.linuxquestions.org/questions/
Reply 0 comments