Re: Noting EVERY File Write/Change/Delete in (near) Real Time ???

From	John-Paul Stewart <jpstewart@personalprojects.net>
Newsgroups	comp.os.linux.misc
Subject	Re: Noting EVERY File Write/Change/Delete in (near) Real Time ???
Date	2022-09-12 19:48 -0400
Message-ID	<jo9ur7FqqefU1@mid.individual.net> (permalink)
References	<QA-dna7ohPr3Nof-nZ2dnZfqn_th4p2d@earthlink.com> <tfgu2e$80b$2@tncsrv09.home.tnetconsulting.net>

Show all headers | View raw

On 2022-09-10 01:48, Grant Taylor wrote:
> On 9/8/22 8:55 PM, 25B.Z969 wrote:
>> Any ideas ?
> 
> You might try researching some of the system accounting and / or system
> auditing functions.  One or both of them might have something that can
> trigger when a write happens.

In addition to those suggestions, I can't help but get the feeling that
what the OP is looking for is a lot like the filesystem journal concept.
 It might be worth trying to read and/or preserve the journal with
debugfs (see its logdump command).  There's also the jls command from
the sleuthkit package for examining the journal.

Or there's the option of custom code in the kernel to preserve
filesystem journal entries directly, if all else fails.

Back to comp.os.linux.misc | Previous | Next — Previous in thread | Next in thread | Find similar

Thread

Noting EVERY File Write/Change/Delete in (near) Real Time ??? "25B.Z969" <25B.Z969@noda.net> - 2022-09-08 22:55 -0400
  Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? Robert Riches <spamtrap42@jacob21819.net> - 2022-09-09 03:29 +0000
    Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? "25B.Z969" <25B.Z969@noda.net> - 2022-09-09 23:41 -0400
      Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? Robert Riches <spamtrap42@jacob21819.net> - 2022-09-10 04:15 +0000
        Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? "25B.Z969" <25B.Z969@noda.net> - 2022-09-10 22:51 -0400
  Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? "David W. Hodgins" <dwhodgins@nomail.afraid.org> - 2022-09-09 01:19 -0400
    Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? Richard Kettlewell <invalid@invalid.invalid> - 2022-09-09 08:21 +0100
      Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? "25B.Z969" <25B.Z969@noda.net> - 2022-09-09 23:56 -0400
  Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? Richard Kettlewell <invalid@invalid.invalid> - 2022-09-09 08:22 +0100
    Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? "25B.Z969" <25B.Z969@noda.net> - 2022-09-10 00:09 -0400
      Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? The Natural Philosopher <tnp@invalid.invalid> - 2022-09-10 14:14 +0100
        Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? "25B.Z969" <25B.Z969@noda.net> - 2022-09-14 21:54 -0400
  Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? Grant Taylor <gtaylor@tnetconsulting.net> - 2022-09-09 23:48 -0600
    Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? John-Paul Stewart <jpstewart@personalprojects.net> - 2022-09-12 19:48 -0400
      Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? "25B.Z969" <25B.Z969@noda.net> - 2022-09-15 23:44 -0400
        Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? "26C.Z968" <26C.Z968@noada.net> - 2022-09-30 00:18 -0400
          Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? Fritz Wuehler <fritz@spamexpire-202209.rodent.frell.theremailer.net> - 2022-09-30 14:39 +0200
            Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? "26C.Z968" <26C.Z968@noada.net> - 2022-10-01 00:30 -0400
              Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? Joe Beanfish <joebeanfish@nospam.duh> - 2022-10-04 14:18 +0000
                Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? Joe Beanfish <joebeanfish@nospam.duh> - 2022-10-04 14:25 +0000
                Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? "26C.Z968" <26C.Z968@noada.net> - 2022-10-14 23:30 -0400
                Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? The Natural Philosopher <tnp@invalid.invalid> - 2022-10-15 08:53 +0100
                Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? "26C.Z968" <26C.Z968@noada.net> - 2022-10-15 22:34 -0400
                Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? The Natural Philosopher <tnp@invalid.invalid> - 2022-10-16 11:12 +0100
                Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? "26C.Z968" <26C.Z968@noada.net> - 2022-10-16 21:51 -0400
                Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? Anssi Saari <as@sci.fi> - 2022-10-17 11:50 +0300
                Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? Richard Kettlewell <invalid@invalid.invalid> - 2022-10-17 17:58 +0100
                Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? Richard Kettlewell <invalid@invalid.invalid> - 2022-10-16 12:24 +0100
                Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? "26C.Z968" <26C.Z968@noada.net> - 2022-10-16 21:12 -0400
                Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? Rich <rich@example.invalid> - 2022-10-18 14:15 +0000
                Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? "26C.Z968" <26C.Z968@noada.net> - 2022-10-27 00:38 -0400
          Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? Rich <rich@example.invalid> - 2022-09-30 14:18 +0000
            Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? Richard Kettlewell <invalid@invalid.invalid> - 2022-09-30 20:54 +0100
          Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? Richard Kettlewell <invalid@invalid.invalid> - 2022-09-30 20:53 +0100

csiph-web