From owner-freebsd-questions@FreeBSD.ORG  Sat Nov 22 17:58:18 2003
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 0266516A4CE
	for <questions@freebsd.org>; Sat, 22 Nov 2003 17:58:18 -0800 (PST)
Received: from smtp03.mrf.mail.rcn.net (smtp03.mrf.mail.rcn.net
	[207.172.4.62])	by mx1.FreeBSD.org (Postfix) with ESMTP id 6452043FE1
	for <questions@freebsd.org>; Sat, 22 Nov 2003 17:58:16 -0800 (PST)
	(envelope-from roberthuff@rcn.com)
Received: from 209-6-197-67.c3-0.smr-ubr1.sbo-smr.ma.cable.rcn.com
	([209.6.197.67] helo=jerusalem.litteratus.org.litteratus.org)
	by smtp03.mrf.mail.rcn.net with esmtp (Exim 3.35 #4)
	id 1ANjVv-0003XN-00
	for questions@freebsd.org; Sat, 22 Nov 2003 20:58:15 -0500
From: Robert Huff <roberthuff@rcn.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-ID: <16320.5175.69241.145102@jerusalem.litteratus.org>
Date: Sat, 22 Nov 2003 20:58:15 -0500
To: questions@freebsd.org
In-Reply-To: <20031123002851.GD82843@wantadilla.lemis.com>
References: <200311222258.hAMMwApd092388@fw.farid-hajji.net>
	<20031123002851.GD82843@wantadilla.lemis.com>
X-Mailer: VM 7.14 under 21.5  (beta15) "celery" XEmacs Lucid
Subject: Re: Monitoring a file?
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sun, 23 Nov 2003 01:58:18 -0000


> Problem description:
> ====================
>
>  A file, let's say, /path/to/a/file, is being modified by
>  an unknown process P(u) at random times. Unfortunately,
>  the name of the program ran by P(u) is unknown.
>
>  The goal is to catch P(u) "red-handed," just the moment
>  it accesses /path/to/a/file, e.g. by looking up in the
>  process table with ps(1).

	Have you tried moving the file elsewhere and seeing if anyone
complains about the absence?
	Or writing a program that locks the file?


				Robert Huff