audit.sh

#!/bin/bash

file=/root/audit.files

# vaciamos reglas

auditctl -D

# funcion enviar mail

enviar_mail() {

    # codigo para uso de
    # correo.
    echo "$1" | mail -s "Resporte de audit $(date)" educacionit
    echo ""

}

while read -r line; do
    # cargar reglas
    auditctl -w $line -p wa -k reglas
done < "$file"

while :;do

    reporte=$(ausearch --start recent --raw | aureport --file)

    if [ $(echo $reporte | grep 'no events of interest were found' >> /dev/null) ];then
        echo "nada que reportar"
    else
        echo "Cambios para reportar:"
        echo "$reporte"
        enviar_mail "$reporte"
    fi
sleep 10

done