lkml.org 
[lkml]   [2001]   [Apr]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: real-time file monitoring at the kernel level

    You may want to take a look at the Linux Trace Toolkit which may
    be used to do what you ask for.

    http://www.opersys.com/LTT

    Karim

    Ben Breuninger wrote:
    >
    > Hello,
    >
    > I was wondering if anyone has a patch, or is working on something for what
    > im looking for, or if they are interested in an idea i have (forgive me if
    > this is someone elses idea, ill give credit to them), for file monitoring
    > at the kernel level.
    > I have put up a brief explanation of what im looking for at
    > http://flog.uncontrolled.org/, but in a nutshell, it is this:
    >
    > a kernel patch (or module) that would allow me to have, say, /proc/flog,
    > which shows real-time file monitoring information, which could be tail
    > -f'd like so:
    >
    > root@server~# tail -f /proc/flog
    > modify: root "/var/log/auth.log" 20000410150229
    > access: root "/etc/passwd" 20000410150324
    > modify: root "/etc/passwd" 20000410150441
    > remove: root "/var/log/auth.log" 20000410150502
    > create: root "/usr/bin/.. /" 20000410150534
    > create: root "/usr/bin/.. /backdoor" 20000410150627
    > modify: bob "/home/bob/mailbox" 20000410150854
    > modify: root "/var/www/htdocs/index.html" 20000410150927
    >
    > the above would describe a theoretical breakin from a hacker, which i
    > believe would be extremely useful in intrusion detection. My idea of this
    > is further outlined at http://flog.uncontrolled.org/, including
    > theoretical usage, practice, description, etc.
    > The reason i ask the linux-kernel community is my coding ability does not
    > allow me to hack at the kernel, and so i would need help with this, or any
    > other information that would point me in the right direction that im
    > looking for.
    >
    > If someone is interested in this, or has any information whatsoever,
    > please let me know!
    >
    > thanks,
    > benb@uncontrolled.org
    >
    > PS: im not looking for LIDS
    >
    > -
    > To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    > the body of a message to majordomo@vger.kernel.org
    > More majordomo info at http://vger.kernel.org/majordomo-info.html
    > Please read the FAQ at http://www.tux.org/lkml/

    --
    ===================================================
    Karim Yaghmour
    karym@opersys.com
    Embedded and Real-Time Linux Expert
    ===================================================
    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2005-03-22 13:25    [W:0.025 / U:92.116 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site