Messages in this thread |  | | | Subject | Re: [audit] Upstream solution for auditing file system objects | | From | Valdis.Kletnieks@vt ... | | Date | Fri, 10 Dec 2004 09:29:18 -0500 | |
On Fri, 10 Dec 2004 00:02:31 GMT, Timothy Chavez said:
> Over the last two months, I've been given the daunting task of
> implementing a feature by which an administrator can specify from user
> space, a list of file system objects (namely regular files and
> directories) that he/she wishes to audit.
One *big* question that you don't address at all in your mail:
Do you need *real time* tracking of changes/etc, in which case inotify or
something based on it are probably an approach to follow (note that I don't
think inotify currently deals with read-only access to a file).
Or do you not care about real-time tracking, but have a requirement to be
able to go back and say "Oh, at 9:03:38.99342 last Tuesday, user XYZ
tried to open this file" - if that's what you want, you probably want to
look at the audit subsystem and its support for syscall auditing.
[unhandled content-type:application/pgp-signature] |  |