Re: auditing nfs

Steve Grubb
2008-03-03T21:09:20Z

On Tuesday 26 February 2008 16:54:13 Bob Kryger wrote:
> So, I'm looking to audit file access (via syscalls
> create,open,unlink,etc. because I want every file in the filesystem and
> do not want to have to specify an audit rule for each dir/file) that are
> accessed via nfs from the nfs server. It seems, I assume because nfs is
> in the kernel, that I am not getting any audit messages for those nfs
> files access.
>
> Is my assumption correct?

I think in terms of syscall auditing you should be able to see all the
syscalls. But at somepoint, it should get the path name and add that to the
record. That might be the part where we are missing a hook. Are you getting
syscall opens, but no files?

> Any suggestions for auditing from the nfs server side?

You should be able to place watches there or use syscall auditing. Not sure
what you will get, though, for the user accessing the file.

-Steve