[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: Auditing File Changes




--- eklinger uci edu wrote:

> Good morning. Please forgive me if this has been
> asked, but will the file
> watch functionality be able to intercept writes
> and/or be able to
> intercept the actual changes to the file and report
> those, in addition to
> the fact that the file was modified?

As others have mentioned, the answer is no.

It might be an interesting project to create
a file system that does this level of audit.
Start with efs3's journaling mechanism and
retain all of the update information. True,
you'll run out of space in a hurry, but there
may be environments that would accept that.


Casey Schaufler
casey schaufler-ca com


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]