检测 unix 中的目录变化

Question

How could I track changes of specific directory in UNIX? For example, I launch some utility which create some files during its execution. I want to know what exact files were created during one particular launch. Is there any simple way to get such information? Problem is that:

1. I cannot flush directory content after script execution
2. Files created with the name that has hash as a compound part. There is no possibility to get this hash from script for subsequent search.
3. There could be several scripts executed simultaneously, I do not want to see files created by another process in the same folder.

Please notice that I do not want to know whether directory has been changed as stated here , I need filenames which ideally could be grepped to match specific pattern.

Answer 1

您需要订阅文件系统更改通知。

Answer 2

您应该使用诸如 FAM、gamin 或 inotify 之类的东西来检测文件何时被创建、关闭等。

Answer 3

您可以使用strace -f myscript跟踪脚本进行的所有系统调用，并使用grep过滤创建新文件的系统调用。

Answer 4

您可以使用script命令来跟踪启动的命令。

Answer 5

You could use the Linux Auditing System. Here is a howto link:

http://www.cyberciti.biz/tips/linux-audit-files-to-see-who-made-changes-to-a-file.html