iWatch 0.2.1

There are a number of excellent tools to check filesystem integrity, they are essential part of your system security. These tools allow us to detect unwanted manipulation on our system and report it to the system administrator. However, the administrator will not know about the unauthorized change or the intrusion in to the system until this tool scan the filesystem again, maybe in next few hours or in the next day, it depends on the schedule when and how often we run this filesystem integrity checker.
It is very important to know about the intrusion as soon as possible. It can avoid a big damage if you can react right after the break, not hours later. Unfortunately the current filesystem integrity checker like tripwire, AIDE or samhain dont have the funktionality to alert the system administrator immediately after filesystems integrity is broken . And this is the reason why iWatch is developed, it tries to fill this gap. iWatch monitor the filesystems integrity in realtime and will send alarm immediately to the system administrator when there is any changes in the monitored filesystem.
iWatch is written in Perl and based on inotify, a file change notification system, a kernel features that allows applications to request the monitoring of a set of files against a list of events. Inotify was introduced the first time in the Linux kernel version 2.6.13.
Using iWatch:
iWatch is very simple to use, suppose you want to watch the change in /etc filesystem, you just need to run it in the console
$ iwatch /etc
and iwatch will tell you if something changes in this directory. And if you want to be notified per email:
$ iwatch -m admin@smsgw.local /etc
In this case, the admin will get email notification (maybe you can use your sms gateway account, so you will be alarmed immediately anytime and anywhere).
And if you want to monitor many difference directories you can use a configuration file. This configuration file is an xml file with an easy understandable structure.
Enhancements:
- A -X option was added for specifying exceptions with regular expression.
- New string formats are allowed in command options: %c, the event cookie number, %e, the event name, and %F, the old filename in the case of moved_to events.
- The behavior of sending email was changed.
- Emails are now sent for all defined events.