event.file.monitor
Use the event.file.monitor parameter to enable advanced monitoring for configuration files. To use this parameter, you must have enabled the agent to perform advanced monitoring with the command dacontrol -m.
If advanced monitoring is enabled for files, the auditing service monitors any activity in the following folders:
- /etc/
- /var/centrify/
- /var/centrifydc/
- /var/centrifyda/
The default value for the event.file.monitor parameter is true.
In the audit.log file, you can find these events by looking for the cda_file_monitor_write messages. In the cdc.log file you can find them by looking for the Emit AUDIT_TRAIL.
Doc Feedback