Subject: Re: File system auditing.. like SnoopDOS
To: None <marc@intekmedia.com>
From: Zdenek Salvet <salvet@ics.muni.cz>
List: netbsd-help
Date: 12/29/1998 09:02:19
> 
> Sorry to use a system-specific analogy, but I need a program which
> will insert itself into the system and monitor file system accesses
> (opens/closes or even just an open/close pair.)
> 
> I have lsof--however running lsof constantly and parsing the output
> would not be an ideal solution. I've checked the manual pages and they
> say nothing about a continuous monitoring situation.
> 
> Any assistance in the form of pointers, explanations, and the like
> would certainly be greatly appreciated. I watch the larger netbsd
> mailing lists--feel free to answer me publicly or privately--I'm happy
> with both.
> 
> I'm wondering if it's possible to make a bit of a kernel hook which
> would record such things..?

ktrace -t cn ...

-- 
Zdenek Salvet                                              salvet@ics.muni.cz 
Ustav vypocetni techniky Masarykovy univerzity, Brno
tel.: ++420-5-41 512 257                           Fax: ++420-5-41 212 747
----------------------------------------------------------------------------
           If God had meant for us to be in the Army,
         we would have been born with green, baggy skin.