I'd like a record of every time the cdrom drive is mounted. Ideally this would be in syslog. The system is CentOS 5.5 linux.
While mounting a device, the mount command will issue an open system call. Thus, one approach is to use linux's audit subysystem to log reads on the cdrom device. First, you need to get it enabled.
Now you need to figure out your cdrom device and add the rule to log reads.
Now if I have a shell with my working directory of /var/log and I run
Afterwards there will be three related lines in /var/log/audit/audit.log
This approach isn't a good idea if there are other processes the regularly read the cdrom device. On a Fedora 14 system, the udisks-daemon seems to poll it every second. However, on a CentOS 5.5 system, there doesn't seem to be anything accessing it.