Is there a way to log failed file operations in a linux box?

Question

I wonder if there is a log facility in linux that can be enabled to record failed file operations such as a failure in creating a directory due to permissions or in opening a file for writing so that problematic issues about the filesystem can be easily tracked.

Answer 1

Check out auditd. It's a user space utilities for storing and searching the audit records generated by the audit subsystem in the Linux kernel.

Answer 2

You can set up a centralized log server and configure your syslog daemon to send all the logs (also) to that host. That way if disk errors do occur at your $someserver, then info about that might still get logged to your centralized log server. Installing & configuring such log server is trivial, for example syslog-ng can automatically set up a directory tree like this for you:

/var/log/hosts
/var/log/hosts/host1
/var/log/hosts/host2
/var/log/hosts/host3
...

Also the audit subsystem mentioned is excellent, but if the file system containing /var goes down, it does not have a place where to write unless you have a separate log server or something else set up, too.

If you truly love to tinker and love to log everything, no matter how much disk space it takes, grsecurity has lots of additional audit features. However, grsecurity replaces SELinux, if you use that already.

Answer 3

maybe this is what you need - http://www.dedoimedo.com/computers/audit.html

Answer 4

Personally i use strace to weed out problems like this. http://stackoverflow.com/questions/174942/how-to-use-strace

Blockquote

For example, a code that is trying to search for a file may get a ENOENT (No such file or directory) error but that may be an acceptable scenario in the logic of the code.

Blockquote