Keep running total of file opens/reads?

Question

Is there a linux kernel module or perhaps a different filesystem to keep a running total of the number of times a file has been opened?

I realize this bit would be asking a lot, but if you could also tune it so it doesn't increment the count unless x% of the file was read while it was open, that would be fantastic.

Thanks.

Answer 1

Yes! This would be the inotify system. It's built into the kernel, you just have to hook it. One of the events you can monitor are file-open (IN_OPEN) and file-close (IN_CLOSE). Once you've built a tool to monitor things you can get these counts pretty simply. Unfortunately, it doesn't event on percent-read, just read.

Answer 2

Sounds like a job for auditd and ausearch