Messages in this thread | | | Subject | Re: [RFC] 0/11 fanotify: fscking all notifiction and file access system (intended for antivirus scanning and file indexers) | From | Eric Paris <> | Date | Sat, 27 Sep 2008 10:04:54 -0400 |
| |
On Fri, 2008-09-26 at 23:05 -0700, david@lang.hm wrote: > On Fri, 26 Sep 2008, Eric Paris wrote: > > > fanotify has 7 event types and only sends events for S_ISREG() files. > > The event types are OPEN, READ, WRITE, CLOSE_WRITE, CLOSE_NOWRITE, > > OPEN_ACCESS, and READ_ACCESS. Events OPEN_ACCESS and READ_ACCESS > > require that the listener return some sort of allow/deny/more_time > > response as the original process blocks until it gets an event (or times > > out.) listeners may register a group which will get notifications about > > any combination of these events. Antivirus scanners will likely want > > OPEN_ACCESS and READ_ACCESS while file indexers would likely use the > > non-ACCESS form of these events. > > sending a message out for every READ/WRITE seems like it will generate a > LOT of messages, and very few will be ones that anyone cares about. > > one of the nice things about the TALPA approach was that there was an > ability to notify only on a change of state (i.e. when a file that had > been scanned was changed) > > this could do a similar thing, but I think it would be a much more > expensive process to do it all in userspace.
See the fastpath patch and explaination. Doesn't help for writes...
| |