iWatch 0.0.12 review

There are a number of excellent tools to check filesystem integrity, they are essential part of your system security

License: GPL (GNU General Public License) File size: 0K Developer: Cahya Wirawan

0

There are a number of excellent tools to check filesystem integrity, they are essential part of your system security. These tools allow us to detect unwanted manipulation on our system and report it to the system administrator. However, the administrator will not know about the unauthorized change or the intrusion in to the system until this tool scan the filesystem again, maybe in next few hours or in the next day, it depends on the schedule when and how often we run this filesystem integrity checker.

It is very important to know about the intrusion as soon as possible. It can avoid a big damage if you can react right after the break, not hours later. Unfortunately the current filesystem integrity checker like tripwire, AIDE or samhain don't have the funktionality to alert the system administrator immediately after filesystem's integrity is broken . And this is the reason why iWatch is developed, it tries to fill this gap. iWatch monitor the filesystem's integrity in realtime and will send alarm immediately to the system administrator when there is any changes in the monitored filesystem.

iWatch is written in Perl and based on inotify, a file change notification system, a kernel features that allows applications to request the monitoring of a set of files against a list of events. Inotify was introduced the first time in the Linux kernel version 2.6.13.

Using iWatch:

iWatch is very simple to use, suppose you want to watch the change in /etc filesystem, you just need to run it in the console

$ iwatch /etc

and iwatch will tell you if something changes in this directory. And if you want to be notified per email:

$ iwatch -m admin@smsgw.local /etc

In this case, the admin will get email notification (maybe you can use your sms gateway account, so you will be alarmed immediately anytime and anywhere).

And if you want to monitor many difference directories you can use a configuration file. This configuration file is an xml file with an easy understandable structure.

What's New in This Release:
A pid file is supported in the daemon mode, and it is by default /var/run/iwatch.pid.
The --help and --version options are supported, and their outputs were updated.
The documentation was updated.