Lion Cipher Lab
Monitor file changes in real time with inotify
- Cyber / Security Engineer
- Beginner
- ~30 min
- Free · no account required
Why it matters
Baseline file integrity monitoring is powerful but patient: it takes a snapshot of your system and compares against it on a schedule, so it tells you a file changed, but only at the next check — it is blind in between. A lot of what a defender wants to know is the opposite of patient. When a program suddenly writes a new file into a web root, when something edits a config in /etc, when a binary is swapped while you watch, you want to know at the instant it happens, not at 3 a.m. tonight. Linux has that capability built into the kernel: inotify, a notification system that tells a program the…
What you'll learn
- real-time file monitoring
- using inotifywait
- watching a directory for create/modify/delete/move events
- watching a tree recursively
- logging events with a custom timestamped format
- writing a simple alert-on-change script
- understanding inotify watch limits
- pairing real-time monitoring with baseline FIM
Steps in this lab
- What inotify is, in one breath
- Install inotify-tools
- Watch a directory and see your first event
- Trigger changes and watch them land
- Watch continuously, and watch a whole tree
- Log events with a timestamp, and alert on change
- The honest limits — where real-time watching stops
- Real-time and baseline, together