On Mon, 7 Feb 2005, Nick Strebkov wrote: > > The TrustedBSD Audit code should be able to fill this need -- the goal of > > the Audit code is to be able to track "security critical events" in a > > configurable way, so file open/link/symlink/unlink operations are an > > important subset of that. We hope to integrate the Audit code into 6.x in > > the next few months, and then (in as much as is possible given kernel ABI > > requirements) merge for 5.5. However, this is some time away still, so > > presumably can't help in the short term. The result, though, is an event > > stream file that's mechanically parseable, and the even stream can be > > configured to indicate which types of events are important at a fairly > > fine granularity. > > Sounds great. But i have similar tasks (not so huge amount of files) > and i'd prefer to extend kqueue/kevent with EVFILT_INODE filter to have > ability to monitor changes in file without opening it.
What mechanism do you have in mind for KQueue to notify you as to which file had an event? Robert N M Watson _______________________________________________ freebsd-hackers@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-hackers To unsubscribe, send any mail to "[EMAIL PROTECTED]"
