Timeline for How to determine which process is creating a file?
Current License: CC BY-SA 3.0
11 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| May 23, 2017 at 12:39 | history | edited | CommunityBot |
replaced http://stackoverflow.com/ with https://stackoverflow.com/
|
|
| Apr 13, 2017 at 12:36 | history | edited | CommunityBot |
replaced http://unix.stackexchange.com/ with https://unix.stackexchange.com/
|
|
| Mar 30, 2017 at 21:28 | history | edited | Gilles 'SO- stop being evil' | CC BY-SA 3.0 |
corrected auditctl invocation for modern systems (thanks Jeff McJunkin)
|
| Feb 26, 2015 at 3:29 | comment | added | sandric | loggedFS, is pretty buggy, and it just dumps me sermentation core dumps after some time. And auditfs is enormously slowing my system.. | |
| Sep 4, 2012 at 19:59 | comment | added | puk | I doubt I will find what I am looking for: callbacks for system operations | |
| Sep 2, 2012 at 11:57 | comment | added | Gilles 'SO- stop being evil' | @puk This question was about logging, not about reacting to the operation. That would be a different question. OpenBSD's systrace is the leader here, though I think Linux has other things to offer. | |
| Sep 1, 2012 at 15:45 | comment | added | puk | From my understanding, LoggedFS and audit are like inotify in that they log the information. With something like vim's write feature, first foo.txt.swp is CREATED, then it is MOVED_TO foo.txt. This is logged (I use inotify), but the problem I now have is that when I am reviewing the logs, more often than not, I can no longer stat the foo.txt.swp file. This is creating a great deal of problems for me as the file may be deleted before the DELETE event is logged, so I try to get the file info and the OS complains the file no longer exists. | |
| Jul 13, 2011 at 23:15 | history | edited | Gilles 'SO- stop being evil' | CC BY-SA 3.0 |
reference Michael Mrozek's loggedfs guide (which I requested after writing this answer!)
|
| May 26, 2011 at 11:30 | vote | accept | Anton Barkovsky | ||
| May 25, 2011 at 21:56 | history | edited | Gilles 'SO- stop being evil' | CC BY-SA 3.0 |
make the last sentence easier to parse; added 3 characters in body
|
| May 25, 2011 at 20:55 | history | answered | Gilles 'SO- stop being evil' | CC BY-SA 3.0 |