|
|
|
|
|
|
by tsuraan
2043 days ago
|
|
|
I don't personally do this, but if you're taking scheduled snapshots of your ZFS filesystems, you could also have a scheduled job (say, nightly) that emails you a "zfs diff" [0] between the current snapshot and the one from 24 hours ago. It won't tell you that you've been hit by malware, but an unexpected spike in changes could be something worth investigating. [0] - https://docs.oracle.com/cd/E36784_01/html/E36835/gkkqz.html |
|
|