Re: real-time file monitoring at the kernel level

[Ryan Butler <rbutler@adiis.net>]

you might check out fam and imon (fam is userspace, imon is a kernel patch).

Both are open source SGI tools, imon is the inode monitor.

Both can be found at http://oss.sgi.com


>Hello,
>
>I was wondering if anyone has a patch, or is working on something for what
>im looking for, or if they are interested in an idea i have (forgive me if
>this is someone elses idea, ill give credit to them), for file monitoring
>at the kernel level.
>I have put up a brief explanation of what im looking for at
>http://flog.uncontrolled.org/, but in a nutshell, it is this:
>
>a kernel patch (or module) that would allow me to have, say, /proc/flog,
>which shows real-time file monitoring information, which could be tail
>-f'd like so:
>
>root@server~# tail -f /proc/flog
>modify: root "/var/log/auth.log" 20000410150229
>access: root "/etc/passwd" 20000410150324
>modify: root "/etc/passwd" 20000410150441
>remove: root "/var/log/auth.log" 20000410150502
>create: root "/usr/bin/.. /" 20000410150534
>create: root "/usr/bin/.. /backdoor" 20000410150627
>modify: bob "/home/bob/mailbox" 20000410150854
>modify: root "/var/www/htdocs/index.html" 20000410150927
>
>the above would describe a theoretical breakin from a hacker, which i
>believe would be extremely useful in intrusion detection. My idea of this
>is further outlined at http://flog.uncontrolled.org/, including
>theoretical usage, practice, description, etc.
>The reason i ask the linux-kernel community is my coding ability does not
>allow me to hack at the kernel, and so i would need help with this, or any
>other information that would point me in the right direction that im
>looking for.
>
>If someone is interested in this, or has any information whatsoever,
>please let me know!
>
>thanks,
>benb@uncontrolled.org
>
>PS: im not looking for LIDS
>