# Changing Linux bash startup files and history files. Beats

**URL:** <https://discuss.elastic.co/t/changing-linux-bash-startup-files-and-history-files-beats/75013>\
**Category:** Beats\
**Created:** [February 14, 2017, 10:39am UTC](https://discuss.elastic.co/t/changing-linux-bash-startup-files-and-history-files-beats/75013 "2017-02-14T10:39:30Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Rajasekaran\_Mari](https://avatars.discourse-cdn.com/v4/letter/r/53a042/32.png) [@Rajasekaran\_Mari](https://discuss.elastic.co/u/Rajasekaran_Mari)\
**Post date:** [February 14, 2017, 10:39am UTC](https://discuss.elastic.co/t/changing-linux-bash-startup-files-and-history-files-beats/75013/1 "2017-02-14T10:39:30Z")

</div>

Hi,

kindly help me how to write a watcher script (json Script) for Changing Linux bash startup files and history files. Beats.

send to alert mail to administrator when some one changing bash startup files and history files.

---

<div class="post-metadata">

**Author:** ![tudor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tudor/32/3753_2.png) [@tudor](https://discuss.elastic.co/u/tudor)\
**Post date:** [February 14, 2017, 10:51am UTC](https://discuss.elastic.co/t/changing-linux-bash-startup-files-and-history-files-beats/75013/2 "2017-02-14T10:51:50Z")

</div>

This is unfortunately not easy at the moment as we don't have a Beat that can check the integrity of files. We do consider building something like that, though.

---

<div class="post-metadata">

**Author:** ![Rajasekaran\_Mari](https://avatars.discourse-cdn.com/v4/letter/r/53a042/32.png) [@Rajasekaran\_Mari](https://discuss.elastic.co/u/Rajasekaran_Mari)\
**Post date:** [February 14, 2017, 10:55am UTC](https://discuss.elastic.co/t/changing-linux-bash-startup-files-and-history-files-beats/75013/3 "2017-02-14T10:55:46Z")

</div>

thank you, kindly tell me any possibilities to filter anyone change or Removal of system log contents. email alert.

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [February 14, 2017, 2:15pm UTC](https://discuss.elastic.co/t/changing-linux-bash-startup-files-and-history-files-beats/75013/4 "2017-02-14T14:15:09Z")

</div>

You could setup auditd rules for the files you want to watch. Then have Filebeat read the audit logs, send them to Logstash or Ingest Node to do some parsing. And finally with data in ES you could setup some alerts/watches.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 7, 2017, 10:40am UTC](https://discuss.elastic.co/t/changing-linux-bash-startup-files-and-history-files-beats/75013/5 "2017-03-07T10:40:00Z")

</div>

This topic was automatically closed after 21 days. New replies are no longer allowed.