Monitoring file usage

Monitoring file usage

[Paul Furness]

Hello.

Can anyone give me any pointers to info about monitoring file access on
a linux file server?

I am fairly easily able to monitor how much space is used, how many
files there are, who owns them and so on, but what I really need is a
log of who accessed what file, the time they did it and how long they
had it open for.

After googling for a bit I can find lots of tools that will tell me how
much disk space is in use, but I don't care about how *big* the file is,
only how often it's accessed and by whom.

The file systems are shared using nfs and samba, so users could use
either of those methods to access the file. I guess that I could
probably get somewhere by turning up the debug level on the daemons, but
I feel that would put a big load on the server and log a lot of other
information that I don't want. 

Has anyone come across any software that can do some or all of this sort
of monitoring automatically? Obviously, kgrellm can tell me
instantaneous disk access stats, and mrtg can plot data about, say, disk
space in use, however nothing seems to offer file access / user info.

Any and all suggestions welcome.

Thanks.

Paul

Re: Monitoring file usage

[Glynn Clements]

Paul Furness wrote:

> Can anyone give me any pointers to info about monitoring file access on
> a linux file server?
> 
> I am fairly easily able to monitor how much space is used, how many
> files there are, who owns them and so on, but what I really need is a
> log of who accessed what file, the time they did it and how long they
> had it open for.

> The file systems are shared using nfs and samba, so users could use
> either of those methods to access the file. I guess that I could
> probably get somewhere by turning up the debug level on the daemons, but
> I feel that would put a big load on the server and log a lot of other
> information that I don't want. 

Logging all file access would probably impose a significant load
however you do it. If the daemons provide an option to log file
accesses, that's likely to be the best solution. Otherwise, I suspect
that the alternative is to modify the kernel, i.e. add some printk()
calls to the filesystem code.

-- 
Glynn Clements <glynn.clements@virgin.net>

Re: Monitoring file usage

[Joakim Ryden]

on 07/15/2004 01:27 AM Paul Furness said the following:
> Hello.
> 
> Can anyone give me any pointers to info about monitoring file access on
> a linux file server?
[...]

Using this daemon and a little imagination it shouldn't be too hard to 
accomplish what you want:

http://arbornet.org/~bjk/bubblegum/

--Jo

Re: Monitoring file usage

[Milan P. Stanic]

On Thu, Jul 15, 2004 at 09:27:57AM +0100, Paul Furness wrote:
> Can anyone give me any pointers to info about monitoring file access on
> a linux file server?

google for dnotify and/or fam.
But dnotify seems to disappearing from new kernels.

Re: Monitoring file usage

[Milan P. Stanic]

On Thu, Jul 15, 2004 at 03:46:57PM +0100, chriseb@gmail.com wrote:
> On Thu, 15 Jul 2004 12:40:12 +0200, Milan P. Stanic <mps@rns-nis.co.yu> wrote:
> > On Thu, Jul 15, 2004 at 09:27:57AM +0100, Paul Furness wrote:
> > > Can anyone give me any pointers to info about monitoring file access on
> > > a linux file server?
> > 
> > google for dnotify and/or fam.
> > But dnotify seems to disappearing from new kernels.
> 
> LIDS might be able to do something similiar.

Yes. But LIDS is to complex for inexperienced sysadmins.