A kind of file monitor

A kind of file monitor

[Prateek Donni]

Hey guys , i needed some help on building a file monitor which
monitors alll file accesses and manages historical data of the same,
kindly tell if 'inotify' can be good enough for the same

Re: A kind of file monitor

[Valdis.Kletnieks]

[-- Attachment #1: Type: text/plain, Size: 719 bytes --]

On Tue, 13 Jan 2009 14:35:05 +0530, Prateek Donni said:
> Hey guys , i needed some help on building a file monitor which
> monitors alll file accesses and manages historical data of the same,
> kindly tell if 'inotify' can be good enough for the same

You may or may not be better served looking at the audit subsystem, but
it's unclear what you need. Some things you have to consider:

1) Do you want all reads/writes, or is open/close/mmap sufficient?
2) What latency do you need?  Does the monitor need to deal with it in
real time (the same second or so), or is "auditd writes to a logfile and
we read it from a cron job" good enough?
3) What are the penalties/failure modes if you fail to capture an access event?

[-- Attachment #2: Type: application/pgp-signature, Size: 226 bytes --]