1

Is there a linux kernel module or perhaps a different filesystem to keep a running total of the number of times a file has been opened?

I realize this bit would be asking a lot, but if you could also tune it so it doesn't increment the count unless x% of the file was read while it was open, that would be fantastic.

Thanks.

Improve this question

2 Answers 2

Reset to default
3

Yes! This would be the inotify system. It's built into the kernel, you just have to hook it. One of the events you can monitor are file-open (IN_OPEN) and file-close (IN_CLOSE). Once you've built a tool to monitor things you can get these counts pretty simply. Unfortunately, it doesn't event on percent-read, just read.

Improve this answer
0
0

Sounds like a job for auditd and ausearch

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .