Subject: Re: File system auditing.. like SnoopDOS
To: None <marc@intekmedia.com>
From: Zdenek Salvet <salvet@ics.muni.cz>
List: netbsd-help
Date: 12/29/1998 09:02:19
>
> Sorry to use a system-specific analogy, but I need a program which
> will insert itself into the system and monitor file system accesses
> (opens/closes or even just an open/close pair.)
>
> I have lsof--however running lsof constantly and parsing the output
> would not be an ideal solution. I've checked the manual pages and they
> say nothing about a continuous monitoring situation.
>
> Any assistance in the form of pointers, explanations, and the like
> would certainly be greatly appreciated. I watch the larger netbsd
> mailing lists--feel free to answer me publicly or privately--I'm happy
> with both.
>
> I'm wondering if it's possible to make a bit of a kernel hook which
> would record such things..?
ktrace -t cn ...
--
Zdenek Salvet salvet@ics.muni.cz
Ustav vypocetni techniky Masarykovy univerzity, Brno
tel.: ++420-5-41 512 257 Fax: ++420-5-41 212 747
----------------------------------------------------------------------------
If God had meant for us to be in the Army,
we would have been born with green, baggy skin.