| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <12935.1231888168@turing-police.cc.vt.edu>
Date: Tue, 13 Jan 2009 18:09:28 -0500
From: Valdis.Kletnieks@...edu
To: Prateek Donni <prateek.donni@...il.com>
Cc: linux-kernel@...r.kernel.org
Subject: Re: A kind of file monitor
On Tue, 13 Jan 2009 14:35:05 +0530, Prateek Donni said:
> Hey guys , i needed some help on building a file monitor which
> monitors alll file accesses and manages historical data of the same,
> kindly tell if 'inotify' can be good enough for the same
You may or may not be better served looking at the audit subsystem, but
it's unclear what you need. Some things you have to consider:
1) Do you want all reads/writes, or is open/close/mmap sufficient?
2) What latency do you need? Does the monitor need to deal with it in
real time (the same second or so), or is "auditd writes to a logfile and
we read it from a cron job" good enough?
3) What are the penalties/failure modes if you fail to capture an access event?
Content of type "application/pgp-signature" skipped
Powered by blists - more mailing lists