Make file monitoring program ?

b-RAM · 04-05-2011, 04:52 AM

Hi guys, is there any way to make program in linux machine to make report when some files have been copy to another directory or machine and knows the users who copy the files, i planning to make this program in c, honestly first time i want to make in python when i know about pyinotify and how easy to monitoring the file in machine, but the problem is i cannot integrate that script python to know the users who do that except for the one who create the file.

need advise please, thank's a lot.

JohnGraham · 04-05-2011, 05:13 AM

I'm not clear on why you can't use Python, but if you want to use C have a look at inotify_init(2) and inotify_add_watch(2), and also this brief introduction to using them.

b-RAM · 04-05-2011, 05:35 AM

Thank's for your reply johngraham, i've used and learn about inotify but the problem still same when make the feature about alert copy to another machine and the lack of my skills to integrate it with users who do that, let's say my issue is to print the alert when some users move or delete file i want to know too the users who do that, i've been wandering and test some syscall in linux to see what syscall that can i integrate with inotify. Need advise and sorry about my stupid question but honestly i just want to build up my programming skills in, I can use python and it works fine but still i cannot find a way to integrate with the users who move or delete files, here's what i do:

Code:

import pyinotify, sys, os, time
from stat import ST_UID

wm= pyinotify.WatchManager()
mask = pyinotify.IN_CREATE | pyinotify.IN_MOVE | pyinotify.IN_DELETE
#path = [] i used this for multiple directory path

class HandleEvent(pyinotify.ProcessEvent):
    def process_IN_CREATE(self, event):
        print "creating: ", event.pathname, os.stat(event.pathname)[ST_UID],
            time.asctime()
    def process_IN_DELETE(self, event):
        print "deleting: ", event.pathname, time.asctime()
    def process_IN_MOVE(self, event):
        print "move: ", event.pathname, time.asctime()

p = HandleEvent()
notifier = pyinotify.Notifier(wm, p)
if len(sys.argv) < 1:
    print "usage: python notifier-rev.py <path>"
    raise SystemExit
fpath = sys.argv[1]
wmm = wm.add_watch(fpath, mask, rec=True) #can use "path" variable 4 multiple dir
diff area
notifier.loop()

the code above is first prototype i used and it works fine(basically just do tweaking from Manual), still it just can catch the UID who make
the file.

Nominal Animal · 04-05-2011, 10:47 AM

I think you'd better use the audit interface for this. See man audit_open, man audit_set_enabled, man audit_add_rule_data, and so on. The libaudit interface seems to be available in Python also, although the examples I've seen are all actually using libauparse and the audit daemon.

However, if you only need the reports, I think you'd save yourself a lot of time by checking if auditd does what you want. That way you'd only need to configure it, not write any code yourself. It should be available in all Linux distributions, too.

b-RAM · 04-05-2011, 08:50 PM

Thank's Nom, i will check that out, honestly i want to write code about this for the school homework, i will check that out.
Thank's a lot.