inotifywait

inotifywait monitor changes in Linux file system. It can be used to track file changes. Here is inotifywait command used by bitninja to detect uploaded files. /bin/inotifywait –daemon –recursive –outfile /var/log/bitninja/inotify/inotify.log –fromfile /var/lib/bitninja/monitor.txt –exclude (^/var/cache/buagent/md0.cache.data$|\.MYD$|\.MYI$|\.MAD$|\.MAI$|\.yara$|^/tmp/lshttpd/*\.sock*|^/tmp/lshttpd/\.rtreport\.*|^/var/tmp/clamav-.*|^/tmp/clamav-.*|^/var/lib/bitninja|^/var/log/bitninja|^/var/cache/awstats|^/usr/local/maldetect/quarantine|\.sock$|\.log$|^.*_log$|^.*_log\.processed$|^.*_ssl_log\.webstat$|^/home/accesslog|^/home/virtfs|^/home/cagefs-skeleton/|^/usr/share/cagefs-skeleton/|^/home/.*?/mail/|^/home/cpeasyapache/src/) –timefmt %F %T –format %w%f %e %T –monitor –event create,move,modify