Date: Mon, 10 Feb 2003 07:04:27 +1100 From: Allan Dib <allan@dib.name> To: Kevin Fogleman <krfogleman@comcast.net> Cc: freebsd-questions@FreeBSD.ORG Subject: Re: Monitoring the entire filesystem? Message-ID: <B126728E-3C69-11D7-A402-000393BCC13C@dib.name> In-Reply-To: <3E46AFB9.4060302@comcast.net>
next in thread | previous in thread | raw e-mail | index | archive | help
I use /usr/ports/security/tripwire-131 Works great... -Allan On Monday, February 10, 2003, at 06:44 AM, Kevin Fogleman wrote: > Is there an existing way to monitor the entire filesystem for changes > to any file, particularly changes in extended attributes? > > I've read over the documentation for kqueue, but some things were left > unclear. For example, it appears the man page has not been updated > for 5.0 and thus doesn't specify whether or how extended attributes > can be monitored for modifications. Also, it appears that kqueue > needs a file descriptor for each file that one would want to monitor, > making any large-scale file monitoring impractical. Is there any > other way in FreeBSD to be notified of file modifications in a way > that would allow one to monitor the whole file system or large > portions of it? I don't really need to know whether a particular > attribute changed, but rather just whether any of them changed. > > --Kevin Fogleman > > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-questions" in the body of the message To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?B126728E-3C69-11D7-A402-000393BCC13C>