I have a symbolic link of the form
ubuntu@platform1:~$ ls -lrt
total 28
drwxr-xr-x 4 ubuntu ubuntu 4096 Mar 2 15:02 deploy
lrwxrwxrwx 1 ubuntu ubuntu 14 May 25 18:27 logs -> /var/log/arkin
Disk layout
ubuntu@platform1:~$ df -h
Filesystem Size Used Avail Use% Mounted on
/dev/mapper/vg-var 853G 3.7G 806G 1% /var
/dev/mapper/vg-var+log 49G 1.1G 45G 3% /var/log
/dev/mapper/vg-var+log+audit 20G 60M 19G 1% /var/log/audit
/dev/mapper/vg-home 30G 6.5G 22G 24% /home
But many times I am observing that symbolic link is changed to
drwxr-xr-x 6 ubuntu ubuntu 4096 May 31 08:41 logs
Can someone let me know if there is a way to enable audit logs on the folder /home/ubuntu/logs
so that I can get some idea which operation is breaking the symbolic link and creating a new /home/ubuntu/logs
or some other ways I can debug this problem?
- Filesystem - ext4
- OS - Ubuntu 16.04
EDIT
I followed the steps as suggested in the answer. I had the following symbolic link :-
lrwxrwxrwx 1 ubuntu ubuntu 14 Jun 3 07:26 logs -> /var/log/arkin
Added the below rule in /etc/audit/audit.rules
-a always,exit -F dir=/home/ubuntu/logs -S unlink -S unlinkat -S rename -S renameat -S rmdir -k log_link
Then restarted audit service
ubuntu@vrni-platform:~$ sudo service auditd stop
ubuntu@vrni-platform:~$ sudo service auditd start
Executed the below command
ubuntu@vrni-platform:~$ sudo ln -svf /var/log/arkin /home/ubuntu/logs
'/home/ubuntu/logs/arkin' -> '/var/log/arkin'
But I am not seeing any audit entry
# aureport -k -i | grep log_link