Date: Sun, 09 Feb 2003 19:00:11 -0500 From: Kevin Fogleman <krfogleman@comcast.net> To: freebsd-questions@freebsd.org Subject: Re: Monitoring the entire filesystem? Message-ID: <3E46EB8B.3080702@comcast.net> In-Reply-To: <B126728E-3C69-11D7-A402-000393BCC13C@dib.name> References: <B126728E-3C69-11D7-A402-000393BCC13C@dib.name>
next in thread | previous in thread | raw e-mail | index | archive | help
I was thinking more along the lines of realtime notification of changes, instead of using a program to poll all files that you would want to monitor, which would be inefficient. Something along the lines of FAM, but more scalable. http://oss.sgi.com/projects/fam/ --Kevin Fogleman Allan Dib wrote: > I use /usr/ports/security/tripwire-131 > > Works great... > > > -Allan > > > On Monday, February 10, 2003, at 06:44 AM, Kevin Fogleman wrote: > >> Is there an existing way to monitor the entire filesystem for changes >> to any file, particularly changes in extended attributes? >> >> I've read over the documentation for kqueue, but some things were >> left unclear. For example, it appears the man page has not been >> updated for 5.0 and thus doesn't specify whether or how extended >> attributes can be monitored for modifications. Also, it appears that >> kqueue needs a file descriptor for each file that one would want to >> monitor, making any large-scale file monitoring impractical. Is >> there any other way in FreeBSD to be notified of file modifications >> in a way that would allow one to monitor the whole file system or >> large portions of it? I don't really need to know whether a >> particular attribute changed, but rather just whether any of them >> changed. >> >> --Kevin Fogleman >> >> >> To Unsubscribe: send mail to majordomo@FreeBSD.org >> with "unsubscribe freebsd-questions" in the body of the message > > > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?3E46EB8B.3080702>