Skip to main content

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

7
  • thank you @Artem S. Tashkinov It turns out that there is puppet service running and always modifying my sshd config. Commented Sep 20, 2021 at 8:41
  • @sqr great! What did you use? inotifywait? You may mark my answer as an answer ;-) Commented Sep 20, 2021 at 8:43
  • Hi @Artem, inotifywait doesn't print out the process name which triggered the change, auditd does. Thanks! Commented Sep 21, 2021 at 12:32
  • @sqr I've known about fanotify() for years now but was always too lazy to find utilities using it. Looks like they exist and they are very easy to use. Could be useful for you. Commented Sep 21, 2021 at 13:17
  • thanks. I understand this is a system API instead of utility, so I have to write a short C program to use it? Commented Sep 22, 2021 at 14:26