event.file.monitor

Use the event.file.monitor parameter to enable advanced monitoring for configuration files. To use this parameter, you must have enabled the agent to perform advanced monitoring with the command dacontrol -m.

If advanced monitoring is enabled for files, the auditing service monitors any activity in the following folders:

  • /etc/
  • /var/centrify/
  • /var/centrifydc/
  • /var/centrifyda/

The default value for the event.file.monitor parameter is true.

In the audit.log file, you can find these events by looking for the cda_file_monitor_write messages. In the cdc.log file you can find them by looking for the Emit AUDIT_TRAIL.