I have an assignment to provide auditd
monitoring for a client's server.
The customer has a production Linux server running an ERP application whose source code resides on the server. The standard practice for this product is for programmers to make ad-hoc changes to the code on the production system!!
The client has established a dedicated test environment on another server and would like for me to monitor three specific directories on the production system for changes to the source code and compiled executables. They've had bad code pushed into production in the past, but there was no audit trail/accountability. This is how they would like to enforce the wall between test and production.
The final requirement is for auditd to sense automatic email notification of changes to the monitored directories.
Please halp!!