Re: Noting EVERY File Write/Change/Delete in (near) Real Time ???

From	"25B.Z969" <25B.Z969@noda.net>
Newsgroups	comp.os.linux.misc
Subject	Re: Noting EVERY File Write/Change/Delete in (near) Real Time ???
Date	2022-09-15 23:44 -0400
Organization	Aioe.org NNTP Server
Message-ID	<tg0rf9$bdc$1@gioia.aioe.org> (permalink)
References	<QA-dna7ohPr3Nof-nZ2dnZfqn_th4p2d@earthlink.com> <tfgu2e$80b$2@tncsrv09.home.tnetconsulting.net> <jo9ur7FqqefU1@mid.individual.net>

Show all headers | View raw

On 9/12/22 7:48 PM, John-Paul Stewart wrote:
> On 2022-09-10 01:48, Grant Taylor wrote:
>> On 9/8/22 8:55 PM, 25B.Z969 wrote:
>>> Any ideas ?
>>
>> You might try researching some of the system accounting and / or system
>> auditing functions.  One or both of them might have something that can
>> trigger when a write happens.
> 
> In addition to those suggestions, I can't help but get the feeling that
> what the OP is looking for is a lot like the filesystem journal concept.
>   It might be worth trying to read and/or preserve the journal with
> debugfs (see its logdump command).  There's also the jls command from
> the sleuthkit package for examining the journal.
> 
> Or there's the option of custom code in the kernel to preserve
> filesystem journal entries directly, if all else fails.

   Pretty close ... I want to be informed of every file create/mod/delete
   more or less AS IT HAPPENS across multiple large volumes so I can do
   certain things with that info.

   It's there somewhere. There's a point where the act is finally
   committed, the path is known, and all that's left to do is
   translate it to actual disk locations and write.

   'fanotify' - a poorly-documented bit - can sort of do that by
   polling something. However it's a bit like 'ionotify' in that
   it expects to be focused on one folder non-recursively. Apparently
   it IS possible have it check the entire tree - multiple trees -
   but I'm trying to see what burden that imposes.

   As other projects are pending it'll be a week or so before I
   can fully explore fanotify. I know that a lot of the things
   it's supposed to report don't work - crashes the program.
   File DELETE is important to me and, of course, that's one of
   the things that hangs it all up.

Back to comp.os.linux.misc | Previous | Next — Previous in thread | Next in thread | Find similar

Thread

Noting EVERY File Write/Change/Delete in (near) Real Time ??? "25B.Z969" <25B.Z969@noda.net> - 2022-09-08 22:55 -0400
  Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? Robert Riches <spamtrap42@jacob21819.net> - 2022-09-09 03:29 +0000
    Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? "25B.Z969" <25B.Z969@noda.net> - 2022-09-09 23:41 -0400
      Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? Robert Riches <spamtrap42@jacob21819.net> - 2022-09-10 04:15 +0000
        Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? "25B.Z969" <25B.Z969@noda.net> - 2022-09-10 22:51 -0400
  Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? "David W. Hodgins" <dwhodgins@nomail.afraid.org> - 2022-09-09 01:19 -0400
    Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? Richard Kettlewell <invalid@invalid.invalid> - 2022-09-09 08:21 +0100
      Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? "25B.Z969" <25B.Z969@noda.net> - 2022-09-09 23:56 -0400
  Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? Richard Kettlewell <invalid@invalid.invalid> - 2022-09-09 08:22 +0100
    Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? "25B.Z969" <25B.Z969@noda.net> - 2022-09-10 00:09 -0400
      Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? The Natural Philosopher <tnp@invalid.invalid> - 2022-09-10 14:14 +0100
        Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? "25B.Z969" <25B.Z969@noda.net> - 2022-09-14 21:54 -0400
  Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? Grant Taylor <gtaylor@tnetconsulting.net> - 2022-09-09 23:48 -0600
    Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? John-Paul Stewart <jpstewart@personalprojects.net> - 2022-09-12 19:48 -0400
      Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? "25B.Z969" <25B.Z969@noda.net> - 2022-09-15 23:44 -0400
        Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? "26C.Z968" <26C.Z968@noada.net> - 2022-09-30 00:18 -0400
          Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? Fritz Wuehler <fritz@spamexpire-202209.rodent.frell.theremailer.net> - 2022-09-30 14:39 +0200
            Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? "26C.Z968" <26C.Z968@noada.net> - 2022-10-01 00:30 -0400
              Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? Joe Beanfish <joebeanfish@nospam.duh> - 2022-10-04 14:18 +0000
                Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? Joe Beanfish <joebeanfish@nospam.duh> - 2022-10-04 14:25 +0000
                Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? "26C.Z968" <26C.Z968@noada.net> - 2022-10-14 23:30 -0400
                Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? The Natural Philosopher <tnp@invalid.invalid> - 2022-10-15 08:53 +0100
                Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? "26C.Z968" <26C.Z968@noada.net> - 2022-10-15 22:34 -0400
                Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? The Natural Philosopher <tnp@invalid.invalid> - 2022-10-16 11:12 +0100
                Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? "26C.Z968" <26C.Z968@noada.net> - 2022-10-16 21:51 -0400
                Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? Anssi Saari <as@sci.fi> - 2022-10-17 11:50 +0300
                Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? Richard Kettlewell <invalid@invalid.invalid> - 2022-10-17 17:58 +0100
                Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? Richard Kettlewell <invalid@invalid.invalid> - 2022-10-16 12:24 +0100
                Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? "26C.Z968" <26C.Z968@noada.net> - 2022-10-16 21:12 -0400
                Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? Rich <rich@example.invalid> - 2022-10-18 14:15 +0000
                Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? "26C.Z968" <26C.Z968@noada.net> - 2022-10-27 00:38 -0400
          Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? Rich <rich@example.invalid> - 2022-09-30 14:18 +0000
            Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? Richard Kettlewell <invalid@invalid.invalid> - 2022-09-30 20:54 +0100
          Re: Noting EVERY File Write/Change/Delete in (near) Real Time ??? Richard Kettlewell <invalid@invalid.invalid> - 2022-09-30 20:53 +0100

csiph-web