Auditing files and directories with inotifywait

There might be times when you’ll just want a quick and easy way to monitor a file or a directory in real time. Instead of having audit messages sent to the audit.log file, you can use inotifywait to have a message pop up in your terminal as soon as someone accesses a designated file or directory. This tool is part of the inotify-tools package on both Ubuntu and AlmaLinux. It’s not installed by default, so go ahead and install it if it isn’t already.

To monitor a single file, just do:

donnie@donnie-ca:~$ sudo inotifywait -m /secrets/donnie_file.txt
[sudo] password for donnie: 
Setting up watches.
Watches established.
/secrets/donnie_file.txt OPEN 
/secrets/donnie_file.txt CLOSE_NOWRITE,CLOSE

The /secrets/ directory is set so that only someone with root privileges can access it, so I have to use sudo to make this work. The -m option causes inotifywait to perform continuous monitoring, instead of exiting...