linux 检测文件变化

# 安装inotify-tools
sudo apt-get install inotify-tools

# 使用inotifywait监控目录
inotifywait -m /path/to/directory -e create -e modify -e delete |
while read path action file; do
    echo "The file '$file' $action in directory '$path'"
done

# 创建一个脚本check_file.sh
#!/bin/bash
FILE=/path/to/file
LAST_MODIFIED=$(stat -c %Y "$FILE")
CURRENT_TIME=$(date +%s)

if [ "$LAST_MODIFIED" -ne "$CURRENT_TIME" ]; then
    echo "File has been modified"
fi

# 设置定时任务每分钟检查一次
crontab -e
* * * * * /path/to/check_file.sh

# 安装auditd
sudo apt-get install auditd

# 配置auditd监控文件
sudo auditctl -w /path/to/file -p wa -k file_watch

# 查看审计日志
ausearch -k file_watch