File modification monitoring with checksums

Started by ikopmans, September 02, 2011, 05:00:29 PM

Previous topic - Next topic

ikopmans

Just did it (thanx to NetXMS team advices).

To monitor some file for changes (like /etc/passwd file):
1. Add DCI File.Hash.CRC32(/path/to/file)
2. Create event template (something like "Contents of %6 changed").
3. Add threshold "diff with previous value" (1 sample) not equal (!=) to 0 to generate this event.
4. Don't forget to put file name to Instance field. :)

This should work fine also for MD5 and SHA1 hashes, as string comparison return -1,0,1, so !=0 will do the same trick.