I need some script which will log (just output to the console or file) every access to some disk or directory (either works for me). I would also like to know what exactly (which subdirectory or file) was accessed. My system is ubuntu linux. Is it possible and how can I do it?
1+1. I've been wondering how to monitor a file server, see which directories and files are most popular. Haven't found how to do this in auditd (only per file).– AndrioidJul 11, 2009 at 15:44
Take a look at inotify, that's pretty much exactly what it's built for. IBM have a half-decent introduction (though somewhat out of date) at http://www.ibm.com/developerworks/linux/library/l-inotify.html
If it's to monitor the actions of a single program strace with a simple filter script is what you want, more generally look at SElinux's "auditd".
On the windows side look at filemon from the SysInternals guys.
You can use incron, which is a cron-like tool for filesystem events from inotify.
You can define an action to be executed everytime IN_ACCESS event occur.
Configuration is as easy as cron:
<path> <mask> <command>
<path>is a filesystem path (each whitespace must be prepended by a backslash)
<mask>is a symbolic (see inotify.h; use commas for separating symbols) or numeric mask for events
<command>is an application or script to run on the events
If you are really sure you want to see that large output then you can use auditd. But it may cause infinite loop if you want to print it to a file as any access to a file would mean printing about that to your log file. Printing to log file is also access to a file so it should get printed to log file too. So be careful.
Even if there is no infinite loop the amount of data this will print should be really large. If you change your question to what do you want to achieve with this monitoring may be people can suggest a better way then logging access to all files.
Yes, I want to log access to every file. Thing is, on this specific hard disk I want to keep only seldom accessed files. So when I do it, I want to verify they are really seldom accessed.– amorfisJul 12, 2009 at 7:18
If number of files is not very large then auditd can definately help you as you can configure audit to notify you whenever any of the protected files is being read. But I am not sure whether you can simply specify that all files within this directory should be monitored. You could look for read/execute access on directory but that wont tell you which exact file was read. Jul 12, 2009 at 10:57