Tracing file modifications

gupta_ca · #1 (**permalink**) 08-03-2005

Hello all!

Is there a way or a utility to trace any kind of file changes in a particular directory on any UNIX machine?
The purpose is that in Unix, there are multiple ways of opening and making changes to a file. But internally, there must be something common (a single pipe, etc.) that is being refered by every application or command that performs file modifications. How can I get to that?

Perderabo · #2 (**permalink**) 08-03-2005

Some versions of unix have c2 security features which can trace any system call made by any process. I don't know of any other way to to do what you want. The kernel knows whenever a file is changed, but there are no interfaces to provide the info except for c2 auditing. Beyond that you would need to rewrite the kernel.

blowtorch · #3 (**permalink**) 08-03-2005

There is a product called ETrust that is available from Computer Associates, maybe you could look that up.

Unbeliever · #4 (**permalink**) 08-03-2005

Tripwire is a possibility for tracking file system intergrity. Worth looking at anyway.

More UNIX and Linux Forum Topics You Might Find Helpful
Thread	Thread Starter	Forum	Replies	Last Post
how to write modifications in to two tables	naveeng.81	Shell Programming and Scripting	0	04-09-2008 01:26 PM
question about testing in shell programming(modifications were made)	thungmail	Shell Programming and Scripting	2	04-08-2008 03:51 PM
my shell script (file modifications)	whizkidash	Shell Programming and Scripting	2	03-24-2008 03:50 PM
list files with modifications <15 minutes	tom_k_mishra	UNIX for Dummies Questions & Answers	2	11-11-2005 02:10 AM
In Line File Modifications: Search and Replace	Shakey21	Shell Programming and Scripting	2	11-20-2001 04:21 PM

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search
Display Modes	Rate This Thread
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode	Rate This Thread:


	Powered by