Re: Identifying writes to NFS
On Thursday 31 May 2007 05:34, Matthew Booth wrote:
> man statfs, look at f_type field there.
Looking at this again, this field doesn't appear to be in the audit
data. Am I missing it?
Correct and nope.
It's not possible to invoke statfs to determine this information
as the
system receiving the data is remote.
Sounds like you wrote a relaying program, it would need to do the statfs
against the path in the record and add that data before sending it.
-Steve