Auditing File Changes

Casey Schaufler casey at schaufler-ca.com
Mon Jul 10 20:24:05 UTC 2006



--- Klaus Weidner <klaus at atsec.com> wrote:

> On Mon, Jul 10, 2006 at 12:32:14PM -0700, Casey
> Schaufler wrote:
> > It might be an interesting project to create
> > a file system that does this level of audit.
> > Start with efs3's journaling mechanism and
> > retain all of the update information. True,
> > you'll run out of space in a hurry, but there
> > may be environments that would accept that.
> 
> How about using FUSE (userspace file system) on top
> of a version control
> system (git, subversion, ...), and using the version
> control system's
> change records to keep track of the full history?

I donno, those small writes are going to be
kind of slow.


Casey Schaufler
casey at schaufler-ca.com




More information about the Linux-audit mailing list