Have a weird issue where my known_hosts file is getting deleted periodically. Is there any way I can watch the file to see what may be deleting it? Any OSX logs that can be monitored to see what might be ditching it?
Asked
Active
Viewed 342 times
2
-
There isn't a way to do this with OS X alone. What are the constraints to the problem? – Ramhound Feb 04 '15 at 17:38
1 Answers
2
You can use the audit system to watch for specific events. The file delete is one of them. You can see more details on how to modify this to suit your needs at:
In your case edit /etc/security/audit_control file and add the flag 'fd' for file delete.
In my experience you have to reboot every time you make a change to be sure it works. I have tried to avoid the reboots by issuing command:
audit -s
But it has not been reliable.
Ricardo
- 191
- 4
-
Thanks for the pointer to this, it didn't help me find the culprit here but I've used it very effectively for other things since. – sgargan Mar 01 '15 at 12:31