Anyone know how to see what pid/process has modified a linux routing table (specifically on Ubuntu )? I have an interesting problem where a route that I have created has been deleted over time, but can’t figure out what. I’ve tried rtmon but seems to only show timestamps of the adds/deletes

  • Deckweiss@lemmy.world
    link
    fedilink
    arrow-up
    6
    ·
    edit-2
    10 months ago

    The better solution:

    sudo apt-get install auditd

    Set up watch: sudo auditctl -w /path/to/your/file -p wa -k file_change_monitor

    Check log: sudo ausearch -k file_change_monitor


    Alternative solution:

    If you know the file that is being edited you can set up watches with inotifywait and log it to a file. This may possibly not work because lsof might not be quick enough.

    sudo apt-get install inotify-tools

    then put this script in autostart

    #!/bin/bash
    
    FILE_TO_MONITOR="/path/to/your/file"
    LOG_FILE="/path/to/logfile.txt"
    
    inotifywait -m -e modify,move,create,delete --format '%w %e %T' --timefmt '%Y-%m-%d %H:%M:%S' "$FILE_TO_MONITOR" |
    while read path action time; do
        # Get the PID of the process that last modified the file
        PID=$(lsof -t "$FILE_TO_MONITOR" 2>/dev/null)
    
        # Get the process name using the PID
        PROCESS_NAME=$(ps -p $PID -o comm= 2>/dev/null)
    
        # Log details to the file
        echo "$time: File $path was $action by PID $PID ($PROCESS_NAME)" >> "$LOG_FILE"
    done
    

    Don’t forget to modify the values at the top of the script and make it executable.

    • Mike@sh.itjust.works
      link
      fedilink
      arrow-up
      6
      ·
      10 months ago

      They aren’t asking about changes to a file describing the routing config, rather the actual in-use routing config. Unless the routing rules are modified through a couple of files (which I doubt), this doesn’t answer the question.

      Cool commands though.

        • Mike@sh.itjust.works
          link
          fedilink
          arrow-up
          6
          ·
          edit-2
          10 months ago

          Well, the routes might manifest somewhere as files, but I don’t expect anyone to be able to viably parse them without commands like ip or ifconfig (or know where the files even are).

          Some devices (like disks for example) are very straightforward to use as files, while some other special files (like USB devices) are so weird/ugly to use that everyone uses tools/libraries to access them (like libusb).

          This is very off-topic, but there’s a great talk by Benno Rice that talks about this (among many others): https://youtu.be/9-IWMbJXoLM

  • Shadow@lemmy.ca
    link
    fedilink
    arrow-up
    5
    ·
    edit-2
    10 months ago

    I don’t think any historical data would exist, but you could probably watch changes with ftrace

  • bizdelnick@lemmy.ml
    link
    fedilink
    arrow-up
    4
    ·
    10 months ago

    I guess it can be NetworkManager if it is used to configure the interface but the route is added manually.