Re: Noting EVERY File Write/Change/Delete in (near) Real Time ???

Subject	Re: Noting EVERY File Write/Change/Delete in (near) Real Time ???
Newsgroups	comp.os.linux.misc
References	(4 earlier) <e8ednSG8rJWh86v-nZ2dnZfqn_hj4p2d@earthlink.com> <fb3fbc425ec233bc18c6702c294a30a1@msgid.frell.theremailer.net> <AAqdnW2dZOT0X6r-nZ2dnZfqn_Vj4p2d@earthlink.com> <thhfc2$2li5n$1@dont-email.me> <thhfog$2li5n$2@dont-email.me>
From	"26C.Z968" <26C.Z968@noada.net>
Date	2022-10-14 23:30 -0400
Message-ID	<Ex-cnXD3_Or7tNf-nZ2dnZfqnPednZ2d@earthlink.com> (permalink)

Show all headers | View raw

On 10/4/22 10:25 AM, Joe Beanfish wrote:
> On Tue, 04 Oct 2022 14:18:42 +0000, Joe Beanfish wrote:
> 
>> On Sat, 01 Oct 2022 00:30:32 -0400, 26C.Z968 wrote:
>>
>>> On 9/30/22 8:39 AM, Fritz Wuehler wrote:
>>>> 2>   kernel jocks, we CAN think of uses for knowing EVERY file
>>>> 2>   create/mod/delete no matter where. If there isn't a place to
>>>> 2>   check for those, MAKE one !
>>>>
>>>> What you are asking for could easily lead to an infinite loop:
>>>> recording all filesystem changes on the filesystem being monitored
>>>> is a sure way to crash your system.
>>>
>>>
>>>     Either IQ, or programmed IQ, should solve that problem.
>>>
>>>     The OS is told to create/mod/delete a file. Don't really
>>>     care what or where. All I ask is a way to monitor every
>>>     such event. Full path + filename and action. Nothing
>>>     super-fancy beyond that.
>>
>> If you just want a log to examine as apposed to actually intercepting
>> such events, look at auditd which can log pretty much everything the
>> kernel does. Not sure if it will log writes (modifications) or not,
>> doing so might overwhelm the log on an active system.
> 
> p.s.
> See also systemtap
> 
> or a web search for "linux profiling" (you'll get hits about monitoring
> individual programs as well as the whole system)

   Both interesting suggestions - however auditd lets you
   put a 'watch' on *a* file ... but some of the aforementioned
   utilities can do that and a little bit more. Systemtap is
   basically a customized kernel - and I really really need
   this app to run on nice safe bland trustworthy vanilla kernels.

   It's a vexing problem. Things ARE being read/written/modded/deleted
   but there's no way to SEE/LOG that across all disks/volumes in
   anything approaching an efficient fashion. As said, I don't
   want to "intercept" said ops, just know what they were so I can
   do interesting things with that info a bit later with a fairly
   'nice' process.

Back to comp.os.linux.misc | Previous | Next — Previous in thread | Next in thread | Find similar

Thread

Noting EVERY File Write/Change/Delete in (near) Real Time ??? "25B.Z969" <25B.Z969@noda.net> - 2022-09-08 22:55 -0400
  Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? Robert Riches <spamtrap42@jacob21819.net> - 2022-09-09 03:29 +0000
    Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? "25B.Z969" <25B.Z969@noda.net> - 2022-09-09 23:41 -0400
      Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? Robert Riches <spamtrap42@jacob21819.net> - 2022-09-10 04:15 +0000
        Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? "25B.Z969" <25B.Z969@noda.net> - 2022-09-10 22:51 -0400
  Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? "David W. Hodgins" <dwhodgins@nomail.afraid.org> - 2022-09-09 01:19 -0400
    Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? Richard Kettlewell <invalid@invalid.invalid> - 2022-09-09 08:21 +0100
      Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? "25B.Z969" <25B.Z969@noda.net> - 2022-09-09 23:56 -0400
  Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? Richard Kettlewell <invalid@invalid.invalid> - 2022-09-09 08:22 +0100
    Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? "25B.Z969" <25B.Z969@noda.net> - 2022-09-10 00:09 -0400
      Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? The Natural Philosopher <tnp@invalid.invalid> - 2022-09-10 14:14 +0100
        Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? "25B.Z969" <25B.Z969@noda.net> - 2022-09-14 21:54 -0400
  Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? Grant Taylor <gtaylor@tnetconsulting.net> - 2022-09-09 23:48 -0600
    Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? John-Paul Stewart <jpstewart@personalprojects.net> - 2022-09-12 19:48 -0400
      Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? "25B.Z969" <25B.Z969@noda.net> - 2022-09-15 23:44 -0400
        Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? "26C.Z968" <26C.Z968@noada.net> - 2022-09-30 00:18 -0400
          Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? Fritz Wuehler <fritz@spamexpire-202209.rodent.frell.theremailer.net> - 2022-09-30 14:39 +0200
            Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? "26C.Z968" <26C.Z968@noada.net> - 2022-10-01 00:30 -0400
              Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? Joe Beanfish <joebeanfish@nospam.duh> - 2022-10-04 14:18 +0000
                Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? Joe Beanfish <joebeanfish@nospam.duh> - 2022-10-04 14:25 +0000
                Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? "26C.Z968" <26C.Z968@noada.net> - 2022-10-14 23:30 -0400
                Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? The Natural Philosopher <tnp@invalid.invalid> - 2022-10-15 08:53 +0100
                Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? "26C.Z968" <26C.Z968@noada.net> - 2022-10-15 22:34 -0400
                Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? The Natural Philosopher <tnp@invalid.invalid> - 2022-10-16 11:12 +0100
                Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? "26C.Z968" <26C.Z968@noada.net> - 2022-10-16 21:51 -0400
                Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? Anssi Saari <as@sci.fi> - 2022-10-17 11:50 +0300
                Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? Richard Kettlewell <invalid@invalid.invalid> - 2022-10-17 17:58 +0100
                Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? Richard Kettlewell <invalid@invalid.invalid> - 2022-10-16 12:24 +0100
                Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? "26C.Z968" <26C.Z968@noada.net> - 2022-10-16 21:12 -0400
                Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? Rich <rich@example.invalid> - 2022-10-18 14:15 +0000
                Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? "26C.Z968" <26C.Z968@noada.net> - 2022-10-27 00:38 -0400
          Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? Rich <rich@example.invalid> - 2022-09-30 14:18 +0000
            Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? Richard Kettlewell <invalid@invalid.invalid> - 2022-09-30 20:54 +0100
          Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? Richard Kettlewell <invalid@invalid.invalid> - 2022-09-30 20:53 +0100

csiph-web