Monitor which process create a file

Question

there are two Linux Servers one is Ubuntu14 and the other is Centos7. when users connect with ssh and work, we found some files like below:

I couldn't find any tools to find which process creates it. are my servers infected?

Answer 1

You can't retrospectively determine what process created a file... You have to monitor the system while the file is created.

Use auditd to help you out. Once it's installed and running, run the following as root from the directory listed above:

auditctl -w "$(pwd)/1"
auditctl -w "$(pwd)/=1"

Once you've seen that the file(s) have been created or modified, run the following:

ausearch -f "$(pwd)"

You should see output with records that are delimited by breaks (----).

I see the following having setup a watch on /home/attie/testing, and then using touch to create/update it:

time->Mon Sep 10 14:41:07 2018
type=PROCTITLE msg=audit(1536586867.166:1192): proctitle=746F7563680074657374696E67
type=PATH msg=audit(1536586867.166:1192): item=1 name="testing" inode=8442 dev=00:b8 mode=0100644 ouid=1000 ogid=1000 rdev=00:00 nametype=CREATE
type=PATH msg=audit(1536586867.166:1192): item=0 name="/home/attie" inode=4 dev=00:b8 mode=040701 ouid=1000 ogid=1000 rdev=00:00 nametype=PARENT
type=CWD msg=audit(1536586867.166:1192):  cwd="/home/attie"
type=SYSCALL msg=audit(1536586867.166:1192): arch=c000003e syscall=2 success=yes exit=3 a0=7ffc35557634 a1=941 a2=1b6 a3=69d items=2 ppid=25572 pid=31301 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts2 ses=24669 comm="touch" exe="/bin/touch" key=(null)

Note the following key pieces of information:

• type=PATH [...] item=1 name="testing"
• type=CWD [...] cwd="/home/attie"
• type=SYSCALL [...] exe="/bin/touch"

---

Once you've established what's going on, you'll want to remove the rule(s) - this will delete all rules:

auditctl -D