[rt-users] How can I detect unauthorized changes to RT?

[Jesse Vincent]

On Wed, Mar 29, 2006 at 12:29:39PM -0500, Marc Tisseur wrote:
> Greetings,
> 
> I want to monitor my RT installation for unauthorized changes. I can use an
> intrusion tool to detect changes to the files (AIDE, Tripwire, etc), but I'm
> interested in changes to objects that are stored in the database itself
> (e.g. global scrips, templates, custom fields).
> 
> Has anyone implemented a solution for a similar requirement, or can offer
> better suggestions?
> 

I've not seen this done before, but the suggestion that you dump the
relevant tables and look for changes seems sane. Whatever you end up
with, I'd be thrilled if you could document it on
http://wiki.bestpractical.com 

Thanks,
Jesse