Re: Filesystem access statistics
On Wed, Apr 12, 2006 at 12:26:29PM -0400, Steve Grubb wrote:
I would think that you could write a program to do this via the audit
dispatcher interface. In auditd.conf,
dispatcher = /usr/bin/your-program
log_format = nolog
Will that preempt any other audit users that might be looking for
events downstream? Sounds a bit too drastic, although I guess I am not
the typical case, so an application as "intrusive" as mine won't be
needed on the average system.
if (hdr.type == AUDIT_PATH) {
libaudit.h from audit-libs-devel 1.1.5-1 only has AUDIT_FS_INODE. Is
this new in 1.2 or a typo? I saw mention of a new filesystem API in the
audit RPM changelog. Is that part of it?
You can then set the audit rules for whatever you want to measure, if
all you
want to measure is the opens,
That's a very good question by itself. Anything that peeks into a
directory should do, I guess. That would mean not just opens, but also
directory traversals, unlink calls, etc. Are there aliases of any kind?
The kernel just gained a bunch of new *at() syscalls. If I had written
this a month or two ago, I would have most likely missed them. Is there
a way to look for present and future syscalls dealing with files/inodes?
You can use devmajor and devminor fields to limit the audit system to
reporting opens on an exact partition. This is highly recommended. On my
That's a good idea where applicable. Thanks.
--
Rudi