Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need some script which will log (just output to the console or file) every access to some disk or directory (either works for me). I would also like to know what exactly (which subdirectory or file) was accessed. My system is ubuntu linux. Is it possible and how can I do it?

share|improve this question
1  
+1. I've been wondering how to monitor a file server, see which directories and files are most popular. Haven't found how to do this in auditd (only per file). –  Andrioid Jul 11 '09 at 15:44
add comment

4 Answers

up vote 2 down vote accepted

Take a look at inotify, that's pretty much exactly what it's built for. IBM have a half-decent introduction (though somewhat out of date) at http://www.ibm.com/developerworks/linux/library/l-inotify.html

share|improve this answer
add comment

If it's to monitor the actions of a single program strace with a simple filter script is what you want, more generally look at SElinux's "auditd".

http://en.wikipedia.org/wiki/Strace http://linux.die.net/man/8/auditd

On the windows side look at filemon from the SysInternals guys.

http://technet.microsoft.com/en-us/sysinternals/bb896642.aspx

share|improve this answer
add comment

You can use incron, which is a cron-like tool for filesystem events from inotify.

You can define an action to be executed everytime IN_ACCESS event occur.

Configuration is as easy as cron:

<path> <mask> <command>

Where:

  • <path> is a filesystem path (each whitespace must be prepended by a backslash)
  • <mask> is a symbolic (see inotify.h; use commas for separating symbols) or numeric mask for events
  • <command> is an application or script to run on the events
share|improve this answer
add comment

If you are really sure you want to see that large output then you can use auditd. But it may cause infinite loop if you want to print it to a file as any access to a file would mean printing about that to your log file. Printing to log file is also access to a file so it should get printed to log file too. So be careful.

Even if there is no infinite loop the amount of data this will print should be really large. If you change your question to what do you want to achieve with this monitoring may be people can suggest a better way then logging access to all files.

share|improve this answer
    
Yes, I want to log access to every file. Thing is, on this specific hard disk I want to keep only seldom accessed files. So when I do it, I want to verify they are really seldom accessed. –  amorfis Jul 12 '09 at 7:18
    
If number of files is not very large then auditd can definately help you as you can configure audit to notify you whenever any of the protected files is being read. But I am not sure whether you can simply specify that all files within this directory should be monitored. You could look for read/execute access on directory but that wont tell you which exact file was read. –  Saurabh Barjatiya Jul 12 '09 at 10:57
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.