File System Watch Limits

[Steve Grubb]

Hi,

Someone is trying to use the audit system's watch implementation. They have a 
requirement to watch any changes to /lib & /user/lib and lots of other files. 
At first they placed a watch on the directory thinking that it would get all 
changes. I pointed out that that catches meta-data updates and could miss 
some kinds of events on the files themselves. They created a shell script 
that places an audit rule for each file in the directory.

At about 4500 files this quit working. The events aren't generated and 
auditctl -l stops listing rules. By their estimate, they need to watch 
approximately 90,000 files. 4500 falls far short of what's required.

Anyone have ideas about how to handle this kind of situation? I think we need 
an elegant way to handle this.

-Steve