* Re: Looking for a file monitor
@ 2006-02-25 0:46 Chuck Ebbert
2006-02-25 4:01 ` Hareesh Nagarajan
0 siblings, 1 reply; 11+ messages in thread
From: Chuck Ebbert @ 2006-02-25 0:46 UTC (permalink / raw)
To: Hareesh Nagarajan; +Cc: Diego Calleja, linux-kernel
In-Reply-To: <43FF3C1C.5040200@gmail.com>
On Fri, 24 Feb 2006 at 11:02:20 -0600, Hareesh Nagarajan wrote:
> But if we want to keep a track of all the files that are opened, read,
> written or deleted (much like filemon; ``Filemon's timestamping feature
> will show you precisely when every open, read, write or delete, happens,
> and its status column tells you the outcome."), we can write a simple
> patch that makes a note of these events on the VFS layer, and then we
> could export this information to userspace, via relayfs. It wouldn't be
> too hard to code a relatively efficient implementation.
Doesn't auditing do all this?
I have Fedora Core 4 installed and it comes with the 'audit' RPM.
--
Chuck
"Equations are the Devil's sentences." --Stephen Colbert
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: Looking for a file monitor
2006-02-25 0:46 Looking for a file monitor Chuck Ebbert
@ 2006-02-25 4:01 ` Hareesh Nagarajan
2006-02-25 8:49 ` Arjan van de Ven
0 siblings, 1 reply; 11+ messages in thread
From: Hareesh Nagarajan @ 2006-02-25 4:01 UTC (permalink / raw)
To: Chuck Ebbert; +Cc: Diego Calleja, linux-kernel
Chuck Ebbert wrote:
> In-Reply-To: <43FF3C1C.5040200@gmail.com>
>
> On Fri, 24 Feb 2006 at 11:02:20 -0600, Hareesh Nagarajan wrote:
>
>> But if we want to keep a track of all the files that are opened, read,
>> written or deleted (much like filemon; ``Filemon's timestamping feature
>> will show you precisely when every open, read, write or delete, happens,
>> and its status column tells you the outcome."), we can write a simple
>> patch that makes a note of these events on the VFS layer, and then we
>> could export this information to userspace, via relayfs. It wouldn't be
>> too hard to code a relatively efficient implementation.
>
> Doesn't auditing do all this?
I have no idea about auditing, but I would guess it internally uses inotify.
Hareesh
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: Looking for a file monitor
2006-02-25 4:01 ` Hareesh Nagarajan
@ 2006-02-25 8:49 ` Arjan van de Ven
0 siblings, 0 replies; 11+ messages in thread
From: Arjan van de Ven @ 2006-02-25 8:49 UTC (permalink / raw)
To: Hareesh Nagarajan; +Cc: Chuck Ebbert, Diego Calleja, linux-kernel
On Fri, 2006-02-24 at 22:01 -0600, Hareesh Nagarajan wrote:
> Chuck Ebbert wrote:
> > In-Reply-To: <43FF3C1C.5040200@gmail.com>
> >
> > On Fri, 24 Feb 2006 at 11:02:20 -0600, Hareesh Nagarajan wrote:
> >
> >> But if we want to keep a track of all the files that are opened, read,
> >> written or deleted (much like filemon; ``Filemon's timestamping feature
> >> will show you precisely when every open, read, write or delete, happens,
> >> and its status column tells you the outcome."), we can write a simple
> >> patch that makes a note of these events on the VFS layer, and then we
> >> could export this information to userspace, via relayfs. It wouldn't be
> >> too hard to code a relatively efficient implementation.
> >
> > Doesn't auditing do all this?
>
> I have no idea about auditing, but I would guess it internally uses inotify.
it doesn't; it uses the audit framework which, by the way, exactly does
what the proposed patch above would do :)
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: Looking for a file monitor
2006-02-25 0:40 ` Wei Hu
@ 2006-02-25 4:00 ` Hareesh Nagarajan
0 siblings, 0 replies; 11+ messages in thread
From: Hareesh Nagarajan @ 2006-02-25 4:00 UTC (permalink / raw)
To: Wei Hu; +Cc: Diego Calleja, linux-kernel
Wei Hu wrote:
> Yeah, that's basically what I'm looking for.
> So is it correct that I can keep track of all the actions as inotify events?
Yes, you can. I just looked at the defn of sys_open and I see that
fsnotify_open(f->f_dentry);
gets called, which internally calls:
inotify_dentry_parent_queue_event(...) and,
inotify_inode_queue_event(...)
Do check out inotify. The same applies to other generic operations on
the VFS layer.
Hareesh
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: Looking for a file monitor
2006-02-24 17:02 ` Hareesh Nagarajan
@ 2006-02-25 0:40 ` Wei Hu
2006-02-25 4:00 ` Hareesh Nagarajan
0 siblings, 1 reply; 11+ messages in thread
From: Wei Hu @ 2006-02-25 0:40 UTC (permalink / raw)
To: Hareesh Nagarajan; +Cc: Diego Calleja, linux-kernel
Yeah, that's basically what I'm looking for.
So is it correct that I can keep track of all the actions as inotify events?
> But if we want to keep a track of all the files that are opened, read,
> written or deleted (much like filemon; ``Filemon's timestamping feature
> will show you precisely when every open, read, write or delete, happens,
> and its status column tells you the outcome."), we can write a simple
> patch that makes a note of these events on the VFS layer, and then we
> could export this information to userspace, via relayfs. It wouldn't be
> too hard to code a relatively efficient implementation.
>
> Hareesh
>
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: Looking for a file monitor
2006-02-24 12:05 ` Diego Calleja
@ 2006-02-24 17:02 ` Hareesh Nagarajan
2006-02-25 0:40 ` Wei Hu
0 siblings, 1 reply; 11+ messages in thread
From: Hareesh Nagarajan @ 2006-02-24 17:02 UTC (permalink / raw)
To: Diego Calleja; +Cc: glegoo, linux-kernel
Diego Calleja wrote:
> El Fri, 24 Feb 2006 02:06:27 -0600,
> Hareesh Nagarajan <hnagar2@gmail.com> escribió:
>
>
>> dnotify has been succeeded by inotify. check the link below:
>> http://www.kernel.org/pub/linux/kernel/people/rml/inotify/README
>
> IIRC, inotify is not the best thing for examining system-wide events.
> Monitoring of directories is not recursive (neither it should, i think)
> so to examine the whole system you would need to need thousands of
> watches.
Surely.
But if we want to keep a track of all the files that are opened, read,
written or deleted (much like filemon; ``Filemon's timestamping feature
will show you precisely when every open, read, write or delete, happens,
and its status column tells you the outcome."), we can write a simple
patch that makes a note of these events on the VFS layer, and then we
could export this information to userspace, via relayfs. It wouldn't be
too hard to code a relatively efficient implementation.
Hareesh
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: Looking for a file monitor
[not found] ` <43FEC9EC.7080902@dawes.za.net>
@ 2006-02-24 15:03 ` Wei Hu
0 siblings, 0 replies; 11+ messages in thread
From: Wei Hu @ 2006-02-24 15:03 UTC (permalink / raw)
To: Rogan Dawes; +Cc: linux-kernel
>
> It looks to me like you could use an LD_PRELOAD'ed library to monitor
> such events?
That's a good idea.
Is there an existing tool, or do I need to write a system call wrapper?
>
> Alternatively, consider something like the honeynet monitoring kernel
> monitor module, perhaps.
Could you give more information here?
I'm not familiar with honeynet, thanks.
>
> Rogan
>
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: Looking for a file monitor
2006-02-24 8:06 ` Hareesh Nagarajan
2006-02-24 8:38 ` Wei Hu
@ 2006-02-24 12:05 ` Diego Calleja
2006-02-24 17:02 ` Hareesh Nagarajan
1 sibling, 1 reply; 11+ messages in thread
From: Diego Calleja @ 2006-02-24 12:05 UTC (permalink / raw)
To: Hareesh Nagarajan; +Cc: glegoo, linux-kernel
El Fri, 24 Feb 2006 02:06:27 -0600,
Hareesh Nagarajan <hnagar2@gmail.com> escribió:
> dnotify has been succeeded by inotify. check the link below:
> http://www.kernel.org/pub/linux/kernel/people/rml/inotify/README
IIRC, inotify is not the best thing for examining system-wide events.
Monitoring of directories is not recursive (neither it should, i think)
so to examine the whole system you would need to need thousands of
watches.
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: Looking for a file monitor
2006-02-24 8:06 ` Hareesh Nagarajan
@ 2006-02-24 8:38 ` Wei Hu
2006-02-24 12:05 ` Diego Calleja
1 sibling, 0 replies; 11+ messages in thread
From: Wei Hu @ 2006-02-24 8:38 UTC (permalink / raw)
To: Hareesh Nagarajan; +Cc: linux-kernel
Thanks for the information.
I understand inotify is a replacement for dnotify.
But I still don't get the advantages of it.
What kind of events can I watch?
On 2/24/06, Hareesh Nagarajan <hnagar2@gmail.com> wrote:
> Wei Hu wrote:
> > I looked into dnotify but it was not what I'm looking for. I want a
> > monitor program that can intercept all file access of any process that
> > satisfy a given filter. Is there a program? I searched on Google but
> > had no luck.
>
> dnotify has been succeeded by inotify. check the link below:
> http://www.kernel.org/pub/linux/kernel/people/rml/inotify/README
>
> ./hareesh
>
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: Looking for a file monitor
2006-02-24 7:51 Wei Hu
@ 2006-02-24 8:06 ` Hareesh Nagarajan
2006-02-24 8:38 ` Wei Hu
2006-02-24 12:05 ` Diego Calleja
[not found] ` <43FEC9EC.7080902@dawes.za.net>
1 sibling, 2 replies; 11+ messages in thread
From: Hareesh Nagarajan @ 2006-02-24 8:06 UTC (permalink / raw)
To: Wei Hu; +Cc: linux-kernel
Wei Hu wrote:
> I looked into dnotify but it was not what I'm looking for. I want a
> monitor program that can intercept all file access of any process that
> satisfy a given filter. Is there a program? I searched on Google but
> had no luck.
dnotify has been succeeded by inotify. check the link below:
http://www.kernel.org/pub/linux/kernel/people/rml/inotify/README
./hareesh
^ permalink raw reply [flat|nested] 11+ messages in thread
* Looking for a file monitor
@ 2006-02-24 7:51 Wei Hu
2006-02-24 8:06 ` Hareesh Nagarajan
[not found] ` <43FEC9EC.7080902@dawes.za.net>
0 siblings, 2 replies; 11+ messages in thread
From: Wei Hu @ 2006-02-24 7:51 UTC (permalink / raw)
To: linux-kernel
Hi there,
I'm looking for a file monitor for Linux, basically like filemon
(http://www.sysinternals.com/Utilities/Filemon.html) for Windows. But
it looks like filemon for Linux has been discontinued.
I looked into dnotify but it was not what I'm looking for. I want a
monitor program that can intercept all file access of any process that
satisfy a given filter. Is there a program? I searched on Google but
had no luck.
Thanks,
Wei
^ permalink raw reply [flat|nested] 11+ messages in thread
end of thread, other threads:[~2006-02-25 8:49 UTC | newest]
Thread overview: 11+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2006-02-25 0:46 Looking for a file monitor Chuck Ebbert
2006-02-25 4:01 ` Hareesh Nagarajan
2006-02-25 8:49 ` Arjan van de Ven
-- strict thread matches above, loose matches on Subject: below --
2006-02-24 7:51 Wei Hu
2006-02-24 8:06 ` Hareesh Nagarajan
2006-02-24 8:38 ` Wei Hu
2006-02-24 12:05 ` Diego Calleja
2006-02-24 17:02 ` Hareesh Nagarajan
2006-02-25 0:40 ` Wei Hu
2006-02-25 4:00 ` Hareesh Nagarajan
[not found] ` <43FEC9EC.7080902@dawes.za.net>
2006-02-24 15:03 ` Wei Hu
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).