File monitors

concoran · 04-16-2003, 09:49 PM

Is there any software available to monitor what process is accessing what file, and to find out what changes it made? Something FileMon in windows (from SysInternals.com)

wind · 04-16-2003, 09:55 PM

tripwireÕâ¸ö³ÉÂð£¿

Tinkster · 04-16-2003, 10:51 PM

lsof - it displays open files & processes that access them.

As for the "what modifications" part ... I don't know whether
tripwire (or it's GPL cousin AIDE) will maintain a database
of file contents, but you can certainly set them up so they
alert you if some file has changed.

Cheers,
Tink

cuckoopint · 04-16-2003, 11:36 PM

Quote:

As for the "what modifications" part ... I don't know whether
tripwire (or it's GPL cousin AIDE) will maintain a database
of file contents, but you can certainly set them up so they
alert you if some file has changed.

One could always use a good backup and 'diff'
; )

Tinkster · 04-19-2003, 04:30 PM

What backup-strategy would you be using?
How many diffs (snapshots) a day? ;)
1 every day, one every hour, one every minute?

Or write a new tool (kernel module) that
automatically back-ups a file that's being
opened for write-access? ;)

Cheers,
Tink

concoran · 04-21-2003, 06:10 PM

Thanks for the replies.
I suspect that one of the software I plan to use, makes changes in files not connected in anyway. I was wondering if using some kind of a utility, I would figure that out.

Thx,