linux file access monitor,with inotify?

Question

i am searching a tool in linux for monitoring file. for example, i need know what happend to a file. Like it be created,rewrite,read and so on.

i know the i can use inotify to achieve this. but i need more detail information. for example, i can know the event of creating a file. but what i want not only the file was created but also what the size of the file it created. for example, to read a file, i not only want to know the event reading file i happend but also the detail of reading file, such as the offset of the file it read from.

is there any one can help on this problem ?

Answer 1

auditd is a good choice if you don't want to code your own monitoring tool. Otherwise, using sys/inotify.h gives you information about the file by looking at struct inotify_event struct.

Answer 2

If you need information that detailed then you're going to have to write a kernel module to hook the VFS; even the audit subsystem doesn't have all those details.

Answer 3

As far as I know, the kernel does not have an infrastructure that provides details in that depth. Such support would imply an inordinate amount of monitoring hooks that could even affect the performance of the system. You would have to write kernel code of your own to receive that kind of information...

You also seem to be confused about the granularity of some operations. For example, when a file is created via the open() system call, it is initially empty. You need additional system calls (eg write() or lseek() ) for its size to change. I am not aware of any atomic operation that creates files with a given size.

That said, you might be able to use one or combinations of the following alternatives:

• Use inotify and the stat system call to log operations and file sizes and permissions. Unfortunately this approach is not atomic - and it will not give you read/write offsets.

• Use strace on any process that might be modifying your files. strace logs can be very long and tedious for humans to parse, but provide a lot of information on the operations performed by the traced application.

• If you are interested into specific files, then perhaps you could use a FUSE filesystem to mirror a directory by passing-through all operations, while also recording everything.