I would like to access the linux file system journal, a bit like the windows change journal records (described here).

I could monitor the file system using inotify, but that doesn't allow me to know what happened between two runs of the application.

Is there some API into the linux kernel file system, or do I have to dig into the code of ext3, reiserfs, etc.?

Thanks for you help.

What is it *exactly* you would like to see or monitor and at what level? Is it for testing or production? If testing, isn't 'strace -ewrite' enough?


In userland "debugfs" allows you to list journal contents so it's accessable albeit in a condensed form and not linked to transactions as far as I know. In-kernel disk writes are grouped and queued up (at least that's what I get from "Understanding The Linux Kernel"). I think you need to look at kernel code somewhere around the process signalling it needs to flush data to lower layers.

Thanks for your reply.

I want to know whether (and if so, which) files or directories have been created or deleted. If my application was stopped and is started later on, I would like to know what happened since it was stopped.

It is for production code, not just testing.

Article is somewhat elderly, but I'm sure it will allow you
to find newer information from the links.

http://www-128.ibm.com/developerwork...l-inotify.html


Or you could use an integrity checker like AIDE, tripwire
or (slightly more complex functionality) samhain.


Cheers,
Tink