From owner-freebsd-fs@freebsd.org  Mon Jan  8 16:24:41 2018
Return-Path: <owner-freebsd-fs@freebsd.org>
Delivered-To: freebsd-fs@mailman.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 by mailman.ysv.freebsd.org (Postfix) with ESMTP id 44C07E75A88
 for <freebsd-fs@mailman.ysv.freebsd.org>; Mon,  8 Jan 2018 16:24:41 +0000 (UTC)
 (envelope-from crest@rlwinm.de)
Received: from mail.rlwinm.de (mail.rlwinm.de [IPv6:2a01:4f8:171:f902::5])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (Client did not present a certificate)
 by mx1.freebsd.org (Postfix) with ESMTPS id 0E1F9836C0
 for <freebsd-fs@freebsd.org>; Mon,  8 Jan 2018 16:24:40 +0000 (UTC)
 (envelope-from crest@rlwinm.de)
Received: from crest.bultmann.eu (unknown
 [IPv6:2a00:c380:c0d5:1:995a:4b9c:291a:4ea1])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (No client certificate requested)
 by mail.rlwinm.de (Postfix) with ESMTPSA id EB1E0BD5B
 for <freebsd-fs@freebsd.org>; Mon,  8 Jan 2018 16:24:37 +0000 (UTC)
Subject: Re: kqueue/kevent - watching an entire filesystem?
To: freebsd-fs@freebsd.org
References: <9795fa64-b2dc-50c3-c7e0-8422e0388c15@aldan.algebra.com>
 <CAG6CVpVXdvVAC7up9QRkM-W_NX8KE=+fj8QNhPyOoAE2oxvo=w@mail.gmail.com>
From: Jan Bramkamp <crest@rlwinm.de>
Message-ID: <73b64e9c-1f33-7522-4362-087bbc7e241e@rlwinm.de>
Date: Mon, 8 Jan 2018 17:24:37 +0100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:52.0)
 Gecko/20100101 Thunderbird/52.5.2
MIME-Version: 1.0
In-Reply-To: <CAG6CVpVXdvVAC7up9QRkM-W_NX8KE=+fj8QNhPyOoAE2oxvo=w@mail.gmail.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
X-BeenThere: freebsd-fs@freebsd.org
X-Mailman-Version: 2.1.25
Precedence: list
List-Id: Filesystems <freebsd-fs.freebsd.org>
List-Unsubscribe: <https://lists.freebsd.org/mailman/options/freebsd-fs>,
 <mailto:freebsd-fs-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-fs/>
List-Post: <mailto:freebsd-fs@freebsd.org>
List-Help: <mailto:freebsd-fs-request@freebsd.org?subject=help>
List-Subscribe: <https://lists.freebsd.org/mailman/listinfo/freebsd-fs>,
 <mailto:freebsd-fs-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 08 Jan 2018 16:24:41 -0000



On 25.12.17 18:41, Conrad Meyer wrote:
> If you want to watch whole system activity (and not just a single
> filesystem), that sounds like audit.  Or its crappy cousin,
> filemon(4).  Of course, neither of these options has a kevent-style
> interface, and filemon(4) in particular may miss relevant events.
> 
> I'm afraid there is nothing better than recursively opening
> subdirectories to monitor a tree (even a whole filesystem) with
> kqueue/kevent.

Filemon would be useful in a lot of cases, but it uses newlines as 
record separators without quoting them in the detected paths. See 
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=224015 for more 
details. Few source files contain new files so it won't break building 
sane software in bmake meta mode, but it makes filemon unusable as a 
poor mans inotify replacement for (untrusted) user data.