auditing nfs

[Steve Grubb]

On Tuesday 26 February 2008 16:54:13 Bob Kryger wrote:
> So, I'm looking to audit file access (via syscalls
> create,open,unlink,etc. because I want every file in the filesystem and
> do not want to have to specify an audit rule for each dir/file) that are
> accessed via nfs from the nfs server. It seems, I assume because nfs is
> in the kernel, that I am not getting any audit messages for those nfs
> files access.
>
> Is my assumption correct?

I think in terms of syscall auditing you should be able to see all the 
syscalls. But at somepoint, it should get the path name and add that to the 
record. That might be the part where we are missing a hook. Are you getting 
syscall opens, but no files?

> Any suggestions for auditing from the nfs server side?

You should be able to place watches there or use syscall auditing. Not sure 
what you will get, though, for the user accessing the file.

-Steve