Filesystem access statistics

[Steve Grubb]

On Wednesday 12 April 2006 16:12, Rudi Chiarito wrote:
> On Wed, Apr 12, 2006 at 12:26:29PM -0400, Steve Grubb wrote:
> > I would think that you could write a program to do this via the audit
> > dispatcher interface. In auditd.conf,
> > dispatcher = /usr/bin/your-program
> > log_format = nolog
>
> Will that preempt any other audit users that might be looking for
> events downstream?

Yes  it will, but the audit event dispatcher is not ready yet. So, if you want 
something today, you can just take over the interface. Then re-write it as a 
plugin later when the event dispatcher is finished.

> > if (hdr.type == AUDIT_PATH) {
>
> libaudit.h from audit-libs-devel 1.1.5-1 only has AUDIT_FS_INODE. 

libaudit.h includes linux/audit.h which defines the AUDIT_PATH message type.

> Is this new in 1.2 or a typo? 

Its been around for at least a year.

> I saw mention of a new filesystem API in the audit RPM changelog. Is that
> part of it?

No.

> > You can then set the audit rules for whatever you want to measure, if all
> > you want to measure is the opens,
>
> That's a very good question by itself. Anything that peeks into a
> directory should do, I guess. That would mean not just opens, but also
> directory traversals, unlink calls, etc. Are there aliases of any kind?

No.

> The kernel just gained a bunch of new *at() syscalls. If I had written
> this a month or two ago, I would have most likely missed them. Is there
> a way to look for present and future syscalls dealing with files/inodes?

Not at the moment. 

-Steve