Re: [patch] inotify, improved.

Chris Friesen
2005-06-17T16:36:30Z

Valdis.Kletnieks@vt.edu wrote:

> It's also racy as hell. By the time the inotify gets delivered to the
> userspace process, pid 820 may be long gone.....

Yep. But I can see uses for people to want to log all activity on
specific directory trees. Think audit trails, etc.

Imagine root getting a log like:

Date: Jan 1,2006: file /foo/evidence.txt changed by user blah, pid
<666>, commandline: "vi evidence.txt"

Chris