dump all filesystem access?

KarlisRepsons · Apprentice Joined: 03 Nov 2008 Posts: 229 Location: Latvia

How can I dump all filesystem (files / directories) access in some file or stdout?
lsof shows just for a moment and I can't see what is necessary to be seen...

desultory · Bodhisattva Joined: 04 Nov 2005 Posts: 9410

Moved from Off the Wall to Networking & Security.

iarwain · Apprentice Joined: 25 Sep 2003 Posts: 253

You can keep a log of when a file has been read, written, deleted, etc. in specified directories with audit.

KarlisRepsons · Apprentice Joined: 03 Nov 2008 Posts: 229 Location: Latvia

Well, at the moment I am watching things like this:
echo 1 > /proc/sys/vm/block_dump
watch -n1 'dmesg | tail -n 30'

It shows some info... Also I am almost done with a small C++ code, which uses Inotify, but was more for fun, because Inotify doesn't show the cause of file system event. Audit looked like too monstrous for what I needed.