Dear Twitterverse: I'm looking for a resource (book or similar) that goes into depth on Linux file systems including transaction logs or other important logging mechanisms. Any suggestions? Something analogous to the USN or NTFS logs on Windows.
4
2
3
Replying to @v3rtig0
Also not clear on the context for your request. You could track file access in excessive detail using auditd on Linux, but it would have to be configured beforehand. Won’t help if you’re investigating activity that has already happened.

Nov 1, 2020 · 9:51 AM UTC

1
2
Replying to @hal_pomeranz
I’m looking for a way I can automate the collection of file system related events. I’m collecting a lot of artifacts from target systems, and I know istat is pulling the data from “somewhere”.
1
istat is just returning inode data, nothing else AFAIK
1