Date: Wed, 9 Aug 2000 15:06:45 -0700 (PDT) From: Kris Kennaway <kris@FreeBSD.org> To: =?iso-8859-1?B?SmVz+nMgQXJu4Wl6?= <arnaiz@encomix.es> Cc: freebsd-hackers <freebsd-hackers@FreeBSD.ORG> Subject: Re: Logging changes in files. Message-ID: <Pine.BSF.4.21.0008091503440.43357-100000@freefall.freebsd.org> In-Reply-To: <NEBBIFIPJMPIKMCDPKEJMECOCBAA.arnaiz@encomix.es>
next in thread | previous in thread | raw e-mail | index | archive | help
On Wed, 9 Aug 2000, [iso-8859-1] Jes=FAs Arn=E1iz wrote:
> Hi Everyone!
>=20
> I'm using FreeBSD and I'm interesting in log when a user modifies some fi=
le
> and the changes made on it.
See the kqueue(2) manpage in FreeBSD 4.1. It would be a trivial matter to
write a utility that watches files for activity and logs it, although
finding out who modified the file would be harder.
The "proper" way to do this is using a kernel event audit system, which is
something the TrustedBSD project (www.trustedbsd.org) will provide, but
AFAIK no code is available for this yet.
Kris
--
In God we Trust -- all others must submit an X.509 certificate.
-- Charles Forsythe <forsythe@alum.mit.edu>
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-hackers" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.BSF.4.21.0008091503440.43357-100000>