Is it possible to log every access to disk/directory?

Question

I need some script which will log (just output to the console or file) every access to some disk or directory (either works for me). I would also like to know what exactly (which subdirectory or file) was accessed. My system is ubuntu linux. Is it possible and how can I do it?

Answer 1

Take a look at inotify, that's pretty much exactly what it's built for. IBM have a half-decent introduction (though somewhat out of date) at http://www.ibm.com/developerworks/linux/library/l-inotify.html

Answer 2

If it's to monitor the actions of a single program strace with a simple filter script is what you want, more generally look at SElinux's "auditd".

http://en.wikipedia.org/wiki/Strace http://linux.die.net/man/8/auditd

On the windows side look at filemon from the SysInternals guys.

http://technet.microsoft.com/en-us/sysinternals/bb896642.aspx

Answer 3

You can use incron, which is a cron-like tool for filesystem events from inotify.

You can define an action to be executed everytime IN_ACCESS event occur.

Configuration is as easy as cron:

<path> <mask> <command>

Where:

• <path> is a filesystem path (each whitespace must be prepended by a backslash)
• <mask> is a symbolic (see inotify.h; use commas for separating symbols) or numeric mask for events
• <command> is an application or script to run on the events

Answer 4

If you are really sure you want to see that large output then you can use auditd. But it may cause infinite loop if you want to print it to a file as any access to a file would mean printing about that to your log file. Printing to log file is also access to a file so it should get printed to log file too. So be careful.

Even if there is no infinite loop the amount of data this will print should be really large. If you change your question to what do you want to achieve with this monitoring may be people can suggest a better way then logging access to all files.