<html><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:12pt"><div><span>Could you script something using lsof ?</span></div><div><span></span> </div><div><span>-Mike</span></div><div><br></div> <div style="font-family: times new roman, new york, times, serif; font-size: 12pt;"> <div style="font-family: times new roman, new york, times, serif; font-size: 12pt;"> <font size="2" face="Arial"> <div style="margin: 5px 0px; padding: 0px; border: 1px solid rgb(204, 204, 204); height: 0px; line-height: 0; font-size: 0px;" class="hr" contentEditable="false" readonly="true"></div> <b><span style="font-weight: bold;">From:</span></b> David L. Willson <DLWillson@TheGeek.NU><br> <b><span style="font-weight: bold;">To:</span></b> CLUE's mailing list <clue@cluedenver.org> <br> <b><span style="font-weight: bold;">Sent:</span></b> Sunday, January 8, 2012 11:32 AM<br> <b><span
style="font-weight: bold;">Subject:</span></b> [clue] file-system activity logging<br> </font> <br>
<div id="yiv263249983"><style type="text/css">#yiv263249983 p {margin:0;}</style><div><div style="color: rgb(0, 0, 0); font-family: Times New Roman; font-size: 12pt;">Anyone got a strategy for recording every file open on a particular mount?<br><br>I've googled until my fingers bled, and tried lots and lots of things with lsof. I'm pretty sure I'm barking up the wrong tree or attempting the impossible.<br><br>Here's a relatively detailed use-case:<br><br>I'm on a system, which has a shared file-system mounted as NFSv3. This system reads a small file. The file is only open for about a second.<br><br>I want to record that the file was opened for reading and ideally, the UID that opened it. There are lots of bits of information that would be nice to collect, but those are the basics.<br><br>Repeated runs of lsof are provably unlikely to happen to catch it. So, running it every minute by cron is both wasteful AND ineffective... In fact, I've tried a bunch of
different ways of doing it and it's
really hard to catch this read.<br><br>Ideas?<br><br><span><span></span>David L. Willson<br>Trainer, Engineer, Enthusiast<br>RHCE MCT MCSE Network+ A+ Linux+ LPIC-1 NovellCLA UbuntuCP<br>tel://720.333.LANS<br>Freedom is better when you earn it. Learn Linux.<span></span><br></span><br></div></div></div><br>_______________________________________________<br>clue mailing list: <a href="mailto:clue@cluedenver.org" ymailto="mailto:clue@cluedenver.org">clue@cluedenver.org</a><br>For information, account preferences, or to unsubscribe see:<br><a href="http://cluedenver.org/mailman/listinfo/clue" target="_blank">http://cluedenver.org/mailman/listinfo/clue</a><br><br> </div> </div> </div></body></html>