Re: Auditing File Changes
--- eklinger(a)uci.edu wrote:
Good morning. Please forgive me if this has been
asked, but will the file
watch functionality be able to intercept writes
and/or be able to
intercept the actual changes to the file and report
those, in addition to
the fact that the file was modified?
As others have mentioned, the answer is no.
It might be an interesting project to create
a file system that does this level of audit.
Start with efs3's journaling mechanism and
retain all of the update information. True,
you'll run out of space in a hurry, but there
may be environments that would accept that.
Casey Schaufler
casey(a)schaufler-ca.com