* A kind of file monitor
[not found] <a80c86b70901100833k7a2f3667hcada40f7737530@mail.gmail.com>
@ 2009-01-13 9:05 ` Prateek Donni
2009-01-13 23:09 ` Valdis.Kletnieks
0 siblings, 1 reply; 2+ messages in thread
From: Prateek Donni @ 2009-01-13 9:05 UTC (permalink / raw)
To: linux-kernel
Hey guys , i needed some help on building a file monitor which
monitors alll file accesses and manages historical data of the same,
kindly tell if 'inotify' can be good enough for the same
^ permalink raw reply [flat|nested] 2+ messages in thread* Re: A kind of file monitor
2009-01-13 9:05 ` A kind of file monitor Prateek Donni
@ 2009-01-13 23:09 ` Valdis.Kletnieks
0 siblings, 0 replies; 2+ messages in thread
From: Valdis.Kletnieks @ 2009-01-13 23:09 UTC (permalink / raw)
To: Prateek Donni; +Cc: linux-kernel
[-- Attachment #1: Type: text/plain, Size: 719 bytes --]
On Tue, 13 Jan 2009 14:35:05 +0530, Prateek Donni said:
> Hey guys , i needed some help on building a file monitor which
> monitors alll file accesses and manages historical data of the same,
> kindly tell if 'inotify' can be good enough for the same
You may or may not be better served looking at the audit subsystem, but
it's unclear what you need. Some things you have to consider:
1) Do you want all reads/writes, or is open/close/mmap sufficient?
2) What latency do you need? Does the monitor need to deal with it in
real time (the same second or so), or is "auditd writes to a logfile and
we read it from a cron job" good enough?
3) What are the penalties/failure modes if you fail to capture an access event?
[-- Attachment #2: Type: application/pgp-signature, Size: 226 bytes --]
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2009-01-13 23:09 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
[not found] <a80c86b70901100833k7a2f3667hcada40f7737530@mail.gmail.com>
2009-01-13 9:05 ` A kind of file monitor Prateek Donni
2009-01-13 23:09 ` Valdis.Kletnieks
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®