From mboxrd@z Thu Jan 1 00:00:00 1970 From: devzero@web.de Subject: tracing at filesystem level Date: Fri, 21 Nov 2008 16:53:40 +0100 Message-ID: <515126840@web.de> Mime-Version: 1.0 Content-Type: text/plain; charset=iso-8859-15 Content-Transfer-Encoding: QUOTED-PRINTABLE To: linux-fsdevel@vger.kernel.org Return-path: Received: from fmmailgate05.web.de ([217.72.192.243]:61429 "EHLO fmmailgate05.web.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756190AbYKUPxn convert rfc822-to-8bit (ORCPT ); Fri, 21 Nov 2008 10:53:43 -0500 Received: from web.de by fmmailgate05.web.de (Postfix) with SMTP id 784AC5A31B62 for ; Fri, 21 Nov 2008 16:53:41 +0100 (CET) Sender: linux-fsdevel-owner@vger.kernel.org List-ID: Hello, i`d like to be able to trace filesystem access at early boot time, i.e = to see what files being opened/closed on early boot (and later on). one possible way to do it is using nfs-root, so we can trace it at the = network or server level - but how can this be done without using netwo= rk filesystem ? i came across tracefs (http://www.filesystems.org/docs/tracefs-fast04/t= racefs.pdf) which looks very promising, but it seems it`s not actively = maintained. isn`t there a standard way to do that with recent kernels ? i searched for a while but didn`t find something appropriate.... regards Roland ps: this is also very interesting for intrusion detection - think of virtua= l machine`s filesystem activity being watched trough serial console (i.= e.=20 with nothing running in userspace and without hackers ability to disabl= e it) ____________________________________________________________________ Psssst! Schon vom neuen WEB.DE MultiMessenger geh=F6rt?=20 Der kann`s mit allen: http://www.produkte.web.de/messenger/?did=3D3123 -- To unsubscribe from this list: send the line "unsubscribe linux-fsdevel= " in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html