Log Changes in IP Address

General support questions
Post Reply
rogueakula
Posts: 2
Joined: 2020/05/01 13:49:26

Log Changes in IP Address

Post by rogueakula » 2020/05/01 13:52:49

Do network / IP Address changes get logged anywhere in CentOS 6? I am tasked with making sure we have proper logs in case of an audit. Thanks in advance!

-Josh

User avatar
TrevorH
Forum Moderator
Posts: 28594
Joined: 2009/09/24 10:40:56
Location: Brighton, UK

Re: Log Changes in IP Address

Post by TrevorH » 2020/05/01 14:19:30

DHCP messages get written to syslog and end up in /var/log/messages. You might also find something useful in /var/lib/dhclient/dhclient-${interface}.leases though I have no idea when that is tidied up.
CentOS 6 will die in November 2020 - migrate sooner rather than later!
Info for USB installs on http://wiki.centos.org/HowTos/InstallFromUSBkey
CentOS 5 is dead, do not use it.
Full time Geek, part time moderator. Use the FAQ Luke

rogueakula
Posts: 2
Joined: 2020/05/01 13:49:26

Re: Log Changes in IP Address

Post by rogueakula » 2020/05/01 14:46:53

Thanks for the response. I should have mentioned that we do not use DHCP. All of our addresses are statically assigned. I need to make sure that if someone changes the IP address of an interface it would get logged somewhere. Or at least be able to document that CentOS does not log that. Thanks again!

User avatar
TrevorH
Forum Moderator
Posts: 28594
Joined: 2009/09/24 10:40:56
Location: Brighton, UK

Re: Log Changes in IP Address

Post by TrevorH » 2020/05/01 15:27:18

Nothing will change the ip address on a statically configured machine unless someone has root access to edit the files. If they have that then they can (eventually) bypass all logging anyway...
CentOS 6 will die in November 2020 - migrate sooner rather than later!
Info for USB installs on http://wiki.centos.org/HowTos/InstallFromUSBkey
CentOS 5 is dead, do not use it.
Full time Geek, part time moderator. Use the FAQ Luke

MartinR
Posts: 566
Joined: 2015/05/11 07:53:27
Location: UK

Re: Log Changes in IP Address

Post by MartinR » 2020/05/02 21:28:56

I don't have access to a C6 machine, but have a look to see if arpwatch(8) is available. It keeps track of IP addresses and MACs reporting any new combinations or discrepancies.

Post Reply

Return to “CentOS 6 - General Support”