You may want to take a look at the Linux Trace Toolkit which may
be used to do what you ask for.
Karim
Ben Breuninger wrote:
>
> Hello,
>
> I was wondering if anyone has a patch, or is working on something for what
> im looking for, or if they are interested in an idea i have (forgive me if
> this is someone elses idea, ill give credit to them), for file monitoring
> at the kernel level.
> I have put up a brief explanation of what im looking for at
> http://flog.uncontrolled.org/, but in a nutshell, it is this:
>
> a kernel patch (or module) that would allow me to have, say, /proc/flog,
> which shows real-time file monitoring information, which could be tail
> -f'd like so:
>
> root@server~# tail -f /proc/flog
> modify: root "/var/log/auth.log" 20000410150229
> access: root "/etc/passwd" 20000410150324
> modify: root "/etc/passwd" 20000410150441
> remove: root "/var/log/auth.log" 20000410150502
> create: root "/usr/bin/.. /" 20000410150534
> create: root "/usr/bin/.. /backdoor" 20000410150627
> modify: bob "/home/bob/mailbox" 20000410150854
> modify: root "/var/www/htdocs/index.html" 20000410150927
>
> the above would describe a theoretical breakin from a hacker, which i
> believe would be extremely useful in intrusion detection. My idea of this
> is further outlined at http://flog.uncontrolled.org/, including
> theoretical usage, practice, description, etc.
> The reason i ask the linux-kernel community is my coding ability does not
> allow me to hack at the kernel, and so i would need help with this, or any
> other information that would point me in the right direction that im
> looking for.
>
> If someone is interested in this, or has any information whatsoever,
> please let me know!
>
> thanks,
> benb@uncontrolled.org
>
> PS: im not looking for LIDS
>
> -
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at http://www.tux.org/lkml/
--
===================================================
Karim Yaghmour
karym@opersys.com
Embedded and Real-Time Linux Expert
===================================================
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
This archive was generated by hypermail 2b29 : Sun Apr 15 2001 - 21:00:19 EST