this post was submitted on 05 Jan 2024
27 points (90.9% liked)

Linux

48330 readers
608 users here now

From Wikipedia, the free encyclopedia

Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).

Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.

Rules

Related Communities

Community icon by Alpár-Etele Méder, licensed under CC BY 3.0

founded 5 years ago
MODERATORS
 

Anyone know how to see what pid/process has modified a linux routing table (specifically on Ubuntu )? I have an interesting problem where a route that I have created has been deleted over time, but can't figure out what. I've tried rtmon but seems to only show timestamps of the adds/deletes

top 10 comments
sorted by: hot top controversial new old
[–] [email protected] 6 points 10 months ago* (last edited 10 months ago) (1 children)

The better solution:

sudo apt-get install auditd

Set up watch: sudo auditctl -w /path/to/your/file -p wa -k file_change_monitor

Check log: sudo ausearch -k file_change_monitor


Alternative solution:

If you know the file that is being edited you can set up watches with inotifywait and log it to a file. This may possibly not work because lsof might not be quick enough.

sudo apt-get install inotify-tools

then put this script in autostart

#!/bin/bash

FILE_TO_MONITOR="/path/to/your/file"
LOG_FILE="/path/to/logfile.txt"

inotifywait -m -e modify,move,create,delete --format '%w %e %T' --timefmt '%Y-%m-%d %H:%M:%S' "$FILE_TO_MONITOR" |
while read path action time; do
    # Get the PID of the process that last modified the file
    PID=$(lsof -t "$FILE_TO_MONITOR" 2>/dev/null)

    # Get the process name using the PID
    PROCESS_NAME=$(ps -p $PID -o comm= 2>/dev/null)

    # Log details to the file
    echo "$time: File $path was $action by PID $PID ($PROCESS_NAME)" >> "$LOG_FILE"
done

Don't forget to modify the values at the top of the script and make it executable.

[–] mikey 6 points 10 months ago (1 children)

They aren't asking about changes to a file describing the routing config, rather the actual in-use routing config. Unless the routing rules are modified through a couple of files (which I doubt), this doesn't answer the question.

Cool commands though.

[–] [email protected] 1 points 10 months ago (1 children)

My bad, I thought in Linux everything is a file

[–] mikey 6 points 10 months ago* (last edited 10 months ago) (2 children)

Well, the routes might manifest somewhere as files, but I don't expect anyone to be able to viably parse them without commands like ip or ifconfig (or know where the files even are).

Some devices (like disks for example) are very straightforward to use as files, while some other special files (like USB devices) are so weird/ugly to use that everyone uses tools/libraries to access them (like libusb).

This is very off-topic, but there's a great talk by Benno Rice that talks about this (among many others): https://youtu.be/9-IWMbJXoLM

[–] [email protected] 3 points 10 months ago

Thank you for the info and I'll listen to that talk

[–] [email protected] 2 points 10 months ago (1 children)

Here is an alternative Piped link(s):

https://piped.video/9-IWMbJXoLM

Piped is a privacy-respecting open-source alternative frontend to YouTube.

I'm open-source; check me out at GitHub.

[–] [email protected] -3 points 10 months ago
[–] [email protected] 5 points 10 months ago* (last edited 10 months ago)

I don't think any historical data would exist, but you could probably watch changes with ftrace

[–] [email protected] 4 points 10 months ago

I guess it can be NetworkManager if it is used to configure the interface but the route is added manually.

[–] [email protected] 2 points 10 months ago