How to use inotifywait to monitor specific file directories and operate on files with specific suffixes, such as deletion.

websites always have backdoor files generated with the suffix .php. Because no more .php files will be added to the site, think of using inotifywait to recursively monitor the entire site directory, find the newly created php file, and then delete it. In this way, as long as a backdoor file is created, it will be deleted immediately.
since I am not in operation and maintenance, I hope there is a boss who can help me. Currently, only newly created files are listed in one file.

May.31,2022

currently, you can only monitor characteristic file types:

-sharp!/bin/sh

/usr/bin/inotifywait -drq --timefmt '%d/%m/%y %H:%M' \ 
--format '%T %w %f %e' -o /alidata1/monitor.log  \ 
-e create,move,delete,modify  \
--excludei '.*/*\.html|.*/*\.css|.*/*\.js|.*/*\.txt|.*/*\.bak|.*/*\.jpg|.*/*\.png|.*/*\.gif|.*/*\.jpeg|.*/*\.htm|.*/*\.inc' \
/alidata1/web

like this, you can filter the monitoring of those suffix files.


this is very simple

  1. the inotify background process monitors the specified directory in real time.
  2. receives the add file operation to check if it is a php suffix (this point should be detected not just by the suffix).
  3. if it is a backdoor, delete it, otherwise you can give up, or record to a file and other operations.
< H1 > are there any difficulties here? < / H1 >
MySQL Query : SELECT * FROM `codeshelper`.`v9_news` WHERE status=99 AND catid='6' ORDER BY rand() LIMIT 5
MySQL Error : Disk full (/tmp/#sql-temptable-64f5-1b36161-2bfee.MAI); waiting for someone to free some space... (errno: 28 "No space left on device")
MySQL Errno : 1021
Message : Disk full (/tmp/#sql-temptable-64f5-1b36161-2bfee.MAI); waiting for someone to free some space... (errno: 28 "No space left on device")
Need Help?