Re: Watching a file system

["Steve O'Hara-Smith" <steve@xxxxxxxxxx>]

On Tue, 26 Jun 2007 12:41:08 -0700 (PDT)
Matthew Dillon <dillon@apollo.backplane.com> wrote:

> 
> :Is there a way to log all pathnames accessed by a specific mounted
> :file system? 
> :------
> :Dave Hayes - Consultant - Altadena CA, USA - dave@jetcafe.org 
> :>>> The opinions expressed above are entirely my own <<<
> 
>     You can monitor system calls made by programs with ktrace.
> 
>     you can monitor *MODIFYING* operations to filesystems with the
>     journaling support, e.g.:
> 
>     mountctl -a -o fd=1 /tmp:monitor | jscan -d
> 
>     Hmm. mountctl -l doesn't work.  I'll go fix that.

	While you're at it would you commit the patch for implementing
jscan -o (in the submit@ archives title "Patch to implemet jscan -o") ?
Ah heck here it is again :)

Index: jscan/dump_output.c
===================================================================
RCS file: /home/dcvs/src/sbin/jscan/dump_output.c,v
retrieving revision 1.3
diff -u -r1.3 dump_output.c
--- jscan/dump_output.c 7 Sep 2005 19:10:09 -0000       1.3
+++ jscan/dump_output.c 28 Jan 2007 16:05:17 -0000
@@ -39,5 +39,11 @@
 void
 dump_output(struct jsession *ss, struct jdata *jd)
 {
+    int written = write (STDOUT_FILENO, jd->jd_data, jd->jd_size);
+    if (written != jd->jd_size)
+    {
+        perror ("Write to stdout failed");
+        exit (1);
+    }
     jsession_update_transid(ss, jd->jd_transid);
 }

-- 
C:>WIN                                      |   Directable Mirror Arrays
The computer obeys and wins.                | A better way to focus the sun
You lose and Bill collects.                 |    licences available see
                                            |    http://www.sohara.org/