Filesystem access statistics

[Rudi Chiarito]

On Wed, Apr 12, 2006 at 12:26:29PM -0400, Steve Grubb wrote:
> I would think that you could write a program to do this via the audit 
> dispatcher interface. In auditd.conf, 
> dispatcher = /usr/bin/your-program
> log_format = nolog

Will that preempt any other audit users that might be looking for
events downstream? Sounds a bit too drastic, although I guess I am not
the typical case, so an application as "intrusive" as mine won't be
needed on the average system.

> if (hdr.type == AUDIT_PATH) {

libaudit.h from audit-libs-devel 1.1.5-1 only has AUDIT_FS_INODE. Is
this new in 1.2 or a typo? I saw mention of a new filesystem API in the
audit RPM changelog. Is that part of it?

> You can then set the audit rules for whatever you want to measure, if all you 
> want to measure is the opens,

That's a very good question by itself. Anything that peeks into a
directory should do, I guess. That would mean not just opens, but also
directory traversals, unlink calls, etc. Are there aliases of any kind?
The kernel just gained a bunch of new *at() syscalls. If I had written
this a month or two ago, I would have most likely missed them. Is there
a way to look for present and future syscalls dealing with files/inodes?  

> You can use devmajor and devminor fields to limit the audit system to 
> reporting opens on an exact partition. This is highly recommended. On my 

That's a good idea where applicable. Thanks.

-- 
Rudi