Skip site navigation (1)Skip section navigation (2)
Date:      Mon, 10 Feb 2003 07:04:27 +1100
From:      Allan Dib <allan@dib.name>
To:        Kevin Fogleman <krfogleman@comcast.net>
Cc:        freebsd-questions@FreeBSD.ORG
Subject:   Re: Monitoring the entire filesystem?
Message-ID:  <B126728E-3C69-11D7-A402-000393BCC13C@dib.name>
In-Reply-To: <3E46AFB9.4060302@comcast.net>

next in thread | previous in thread | raw e-mail | index | archive | help
I use /usr/ports/security/tripwire-131

Works great...


-Allan


On Monday, February 10, 2003, at 06:44 AM, Kevin Fogleman wrote:

> Is there an existing way to monitor the entire filesystem for changes 
> to any file, particularly changes in extended attributes?
>
> I've read over the documentation for kqueue, but some things were left 
> unclear.  For example, it appears the man page has not been updated 
> for 5.0 and thus doesn't specify whether or how extended attributes 
> can be monitored for modifications.  Also, it appears that kqueue 
> needs a file descriptor for each file that one would want to monitor, 
> making any large-scale file monitoring impractical.  Is there any 
> other way in FreeBSD to be notified of file modifications in a way 
> that would allow one to monitor the whole file system or large 
> portions of it?  I don't really need to know whether a particular 
> attribute changed, but rather just whether any of them changed.
>
> --Kevin Fogleman
>
>
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-questions" in the body of the message


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?B126728E-3C69-11D7-A402-000393BCC13C>