File watching

[Timothy R. Chavez]

On Tue, 2006-06-20 at 14:32 -0400, Steve wrote:
> >> Instead, you audit the file open, and make a note of whether the file
> >> was opened read-only, or for read/write.  If it was opened for
> >> read/write, one presumes that it was written to.
> 
> Is it possible to tell if a file was opened read/write or read-only from 
> the events generated by audit?
> 
> Thanks,
> Steve

Hi Steve,

You should be able to ascertain this information from the open() audit
record.  I thought at one time the flags were recorded in the record,
but perhaps no longer (or maybe my memory does not serve me well :)).
The record does record syscall arguments, however, so perhaps you could
analyze a1= (I believe this is the argument that passes flags), and
figure out with what flags open() was called with.  Admittedly, I'm not
so knowledgeable these days as to what is actually being reported in the
audit log.

-tim