Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'd like a record of every time the cdrom drive is mounted. Ideally this would be in syslog. The system is CentOS 5.5 linux.

share|improve this question
add comment

1 Answer

While mounting a device, the mount command will issue an open system call. Thus, one approach is to use linux's audit subysystem to log reads on the cdrom device. First, you need to get it enabled.

yum install audit
chkconfig auditd on
service auditd start
auditctl -e 1

Now you need to figure out your cdrom device and add the rule to log reads.

readlink -f /dev/cdrom
auditctl -w /dev/sr0 -p r

Now if I have a shell with my working directory of /var/log and I run

mount /dev/sr0

Afterwards there will be three related lines in /var/log/audit/audit.log

type=SYSCALL msg=audit(1301280283.689:15549): arch=c000003e syscall=2 success=yes exit=3 a0=7f0d3af92820 a1=0 a2=0 a3=1 items=1 ppid=14660 pid=14661 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts4 ses=231 comm="mount" exe="/bin/mount" key=(null)

type=CWD msg=audit(1301280283.689:15549): cwd="/var/log"

type=PATH msg=audit(1301280283.689:15549): item=0 name="/dev/sr0" inode=5821 dev=00:05 mode=060660 ouid=0 ogid=11 rdev=0b:00

This approach isn't a good idea if there are other processes the regularly read the cdrom device. On a Fedora 14 system, the udisks-daemon seems to poll it every second. However, on a CentOS 5.5 system, there doesn't seem to be anything accessing it.

share|improve this answer
    
This works pretty well at getting the event logged to a file, but I was really hoping to be able to send it to syslog. –  Mark Borgerding Mar 31 '11 at 3:14
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.