Re: auditing nfs
On Tuesday 26 February 2008 16:54:13 Bob Kryger wrote:
So, I'm looking to audit file access (via syscalls
create,open,unlink,etc. because I want every file in the filesystem and
do not want to have to specify an audit rule for each dir/file) that are
accessed via nfs from the nfs server. It seems, I assume because nfs is
in the kernel, that I am not getting any audit messages for those nfs
files access.
Is my assumption correct?
I think in terms of syscall auditing you should be able to see all the
syscalls. But at somepoint, it should get the path name and add that to the
record. That might be the part where we are missing a hook. Are you getting
syscall opens, but no files?
Any suggestions for auditing from the nfs server side?
You should be able to place watches there or use syscall auditing. Not sure
what you will get, though, for the user accessing the file.
-Steve