Date: Mon, 8 Jan 2018 17:24:37 +0100 From: Jan Bramkamp <crest@rlwinm.de> To: freebsd-fs@freebsd.org Subject: Re: kqueue/kevent - watching an entire filesystem? Message-ID: <73b64e9c-1f33-7522-4362-087bbc7e241e@rlwinm.de> In-Reply-To: <CAG6CVpVXdvVAC7up9QRkM-W_NX8KE=%2Bfj8QNhPyOoAE2oxvo=w@mail.gmail.com> References: <9795fa64-b2dc-50c3-c7e0-8422e0388c15@aldan.algebra.com> <CAG6CVpVXdvVAC7up9QRkM-W_NX8KE=%2Bfj8QNhPyOoAE2oxvo=w@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On 25.12.17 18:41, Conrad Meyer wrote: > If you want to watch whole system activity (and not just a single > filesystem), that sounds like audit. Or its crappy cousin, > filemon(4). Of course, neither of these options has a kevent-style > interface, and filemon(4) in particular may miss relevant events. > > I'm afraid there is nothing better than recursively opening > subdirectories to monitor a tree (even a whole filesystem) with > kqueue/kevent. Filemon would be useful in a lot of cases, but it uses newlines as record separators without quoting them in the detected paths. See https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=224015 for more details. Few source files contain new files so it won't break building sane software in bmake meta mode, but it makes filemon unusable as a poor mans inotify replacement for (untrusted) user data.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?73b64e9c-1f33-7522-4362-087bbc7e241e>