LinuxQuestions.org
Help answer threads with 0 replies.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Server
User Name
Password
Linux - Server This forum is for the discussion of Linux Software used in a server related context.

Notices

Reply
 
Search this Thread
Old 02-14-2010, 10:55 PM   #1
BenCollver
Rogue Class
 
Registered: Sep 2006
Location: OR, USA
Distribution: Slackware 14.1
Posts: 160

Rep: Reputation: 50
trace writes to file


Does Linux have a way to trace writes to a file?

For each write, I would like to know the time, date, process id, user, file position, byte count, and the data written.

I could use this with a script to replay the writes to a backup of the original file, and reproduce the file contents as they were at a point in time.

-Ben
 
Old 02-15-2010, 01:51 AM   #2
Simon Bridge
Guru
 
Registered: Oct 2003
Location: Waiheke NZ
Distribution: Ubuntu
Posts: 9,211

Rep: Reputation: 197Reputation: 197
It is not clear what you mean by "write". Its meaning in computer science is a bit general for your use. Can you be specific about what you want to do? Right now it looks like you are trying to write spyware.

Perhaps you want a simple output to get recorded to a log, along with details about what it is. May be useful in debugging. An example would be the syslog. This immediately suggests logger(1).

Generally you'd have to write the script to produce the log file you needed.
 
Old 02-15-2010, 11:20 PM   #3
BenCollver
Rogue Class
 
Registered: Sep 2006
Location: OR, USA
Distribution: Slackware 14.1
Posts: 160

Original Poster
Rep: Reputation: 50
I mean the write() system call. I am not considering memory mapped I/O. The write() system call is logged by the strace command, but that is per process. I want to find something that is per inode.

Just as an example, I may have an mbox file that could be written to directly from any number of processes including Thunderbird, mutt, and imapd. I would like to be able to tell what was written by Thunderbird, and what was written by mutt.

How would I write a script to do this? I assure you that I am only going to use this on my own computer.

Thank you,

-Ben
 
Old 11-28-2010, 09:46 AM   #4
BenCollver
Rogue Class
 
Registered: Sep 2006
Location: OR, USA
Distribution: Slackware 14.1
Posts: 160

Original Poster
Rep: Reputation: 50
In BSD this would be done with systrace. In SELinux it can be done with an auditallow policy. This thread solved by SELinux.
 
Old 12-05-2010, 11:30 AM   #5
BenCollver
Rogue Class
 
Registered: Sep 2006
Location: OR, USA
Distribution: Slackware 14.1
Posts: 160

Original Poster
Rep: Reputation: 50
p.s.

There is also auditd(1)
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Java File reads and writes manolakis Programming 2 04-08-2009 12:52 PM
How to trace and disable the HTTP TRACE method in Apache 1.3.33 with FreeBSD? SomnathG Linux - Security 1 11-11-2008 09:41 AM
Redirecting file writes to another location filburt1 Linux - General 5 10-29-2007 04:31 AM
file writes to RAID using posix_fadvise vs O_DIRECT zobtempo Linux - Software 0 05-02-2007 10:11 AM
> writes a new file, how to append? luwigie Linux - General 1 08-26-2004 08:42 PM


All times are GMT -5. The time now is 06:10 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration