Seems to me that you really want auditing.  You can configure the audit
system to only record the events you are interested in.
http://docs.sun.com/app/docs/doc/816-4557/auditov-1?l=en&a=view
  -- richard

On Nov 9, 2009, at 4:55 PM, Andrew Daugherity wrote:

Robert Thurlow <robert.thur...@sun.com> 11/9/2009 4:25 PM >>>
% file /bin/truss /bin/amd64/truss
/bin/truss:     ELF 32-bit LSB executable 80386 Version 1 [FPU],
dynamically linked, not stripped, no debugging information available

/bin/amd64/truss: ELF 64-bit LSB executable AMD64 Version 1 [SSE2
SSE FXSR CMOV FPU], dynamically linked, not stripped, no debugging
information available




It doesn't make any difference if I invoke it with the amd64 truss. The only bart binary I can find on the system (Sol 10u8) is /usr/bin/ bart, and it definitely calls statvfs(). Truss log follows at the end.
I know all about 'find -mtime ...', but that doesn't show which  
files have been deleted, whereas 'rsync -av --delete --backup- 
dir=`date +%Y%m%d`' does.  (When users delete files and then need  
them restored a week later, it's very helpful to know which day they  
were deleted, as I can avoid running a find that could take quite a  
while.  I think incremental zfs snapshots are a better strategy but  
there are little hurdles like this to be crossed.)
bart (or something faster than running 'gdiff -qr snap1 snap2' on a  
snapshots of a 2.1TB-and-growing FS) seems like a great idea, if I  
could find a working tool.  It looks like dircmp(1) might be a  
possibility, but I'm open to suggestions.  I suppose I could use  
something like AIDE or tripwire, although that seems a bit like  
swatting a fly with a sledgehammer.

Thanks,

Andrew



and...@imsfs-new:~$ /usr/bin/amd64/truss bart create -R /export/ims > /tmp/bart-ims
execve("/usr/bin/bart", 0x08047D6C, 0x08047D80)  argc = 4
mmap(0x00000000, 4096, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE| MAP_ANON, -1, 0) = 0xFEFF0000
resolvepath("/usr/lib/ld.so.1", "/lib/ld.so.1", 1023) = 12
resolvepath("/usr/bin/bart", "/usr/bin/bart", 1023) = 13
sysconfig(_CONFIG_PAGESIZE)                     = 4096
stat64("/usr/bin/bart", 0x08047B00)             = 0
open("/var/ld/ld.config", O_RDONLY)             Err#2 ENOENT
stat64("/lib/libsec.so.1", 0x080473A0)          = 0
resolvepath("/lib/libsec.so.1", "/lib/libsec.so.1", 1023) = 16
open("/lib/libsec.so.1", O_RDONLY)              = 3
mmap(0x00010000, 32768, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_ALIGN, 3, 0) = 0xFEFB0000 mmap(0x00010000, 143360, PROT_NONE, MAP_PRIVATE|MAP_NORESERVE| MAP_ANON|MAP_ALIGN, -1, 0) = 0xFEF80000 mmap(0xFEF80000, 50487, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED| MAP_TEXT, 3, 0) = 0xFEF80000 mmap(0xFEF9D000, 11909, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED| MAP_INITDATA, 3, 53248) = 0xFEF9D000 mmap(0xFEFA0000, 8296, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED| MAP_ANON, -1, 0) = 0xFEFA0000
munmap(0xFEF8D000, 65536)                       = 0
memcntl(0xFEF80000, 8844, MC_ADVISE, MADV_WILLNEED, 0, 0) = 0
close(3)                                        = 0
stat64("/lib/libmd.so.1", 0x080473A0)           = 0
resolvepath("/lib/libmd.so.1", "/lib/libmd.so.1", 1023) = 15
open("/lib/libmd.so.1", O_RDONLY)               = 3
mmap(0xFEFB0000, 32768, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 0) = 0xFEFB0000 mmap(0x00010000, 126976, PROT_NONE, MAP_PRIVATE|MAP_NORESERVE| MAP_ANON|MAP_ALIGN, -1, 0) = 0xFEF60000 mmap(0xFEF60000, 56424, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED| MAP_TEXT, 3, 0) = 0xFEF60000 mmap(0xFEF7E000, 552, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED| MAP_INITDATA, 3, 57344) = 0xFEF7E000
munmap(0xFEF6E000, 65536)                       = 0
memcntl(0xFEF60000, 1464, MC_ADVISE, MADV_WILLNEED, 0, 0) = 0
close(3)                                        = 0
stat64("/lib/libc.so.1", 0x080473A0)            = 0
resolvepath("/lib/libc.so.1", "/lib/libc.so.1", 1023) = 14
open("/lib/libc.so.1", O_RDONLY)                = 3
mmap(0xFEFB0000, 32768, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 0) = 0xFEFB0000 mmap(0x00010000, 1208320, PROT_NONE, MAP_PRIVATE|MAP_NORESERVE| MAP_ANON|MAP_ALIGN, -1, 0) = 0xFEE30000 mmap(0xFEE30000, 1099077, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED| MAP_TEXT, 3, 0) = 0xFEE30000 mmap(0xFEF4D000, 30183, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED| MAP_INITDATA, 3, 1101824) = 0xFEF4D000 mmap(0xFEF55000, 4240, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED| MAP_ANON, -1, 0) = 0xFEF55000
munmap(0xFEF3D000, 65536)                       = 0
memcntl(0xFEE30000, 124080, MC_ADVISE, MADV_WILLNEED, 0, 0) = 0
close(3)                                        = 0
stat64("/lib/libavl.so.1", 0x080473A0)          = 0
resolvepath("/lib/libavl.so.1", "/lib/libavl.so.1", 1023) = 16
open("/lib/libavl.so.1", O_RDONLY)              = 3
mmap(0xFEFB0000, 32768, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 0) = 0xFEFB0000 mmap(0x00010000, 73728, PROT_NONE, MAP_PRIVATE|MAP_NORESERVE| MAP_ANON|MAP_ALIGN, -1, 0) = 0xFEE10000 mmap(0xFEE10000, 2788, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED| MAP_TEXT, 3, 0) = 0xFEE10000 mmap(0xFEE21000, 204, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED| MAP_INITDATA, 3, 4096) = 0xFEE21000
munmap(0xFEE11000, 65536)                       = 0
mmap(0x00000000, 4096, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE| MAP_ANON, -1, 0) = 0xFEFC0000
memcntl(0xFEE10000, 1056, MC_ADVISE, MADV_WILLNEED, 0, 0) = 0
close(3)                                        = 0
mmap(0x00010000, 24576, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE| MAP_ANON|MAP_ALIGN, -1, 0) = 0xFEF90000
munmap(0xFEFB0000, 32768)                       = 0
getcontext(0x08047970)
getrlimit(RLIMIT_STACK, 0x08047968)             = 0
getpid()                                        = 14812 [14811]
lwp_private(0, 1, 0xFEF92A00)                   = 0x000001C3
setustack(0xFEF92A60)
sysi86(SI86FPSTART, 0xFEF55740, 0x0000133F, 0x00001F80) = 0x00000001
brk(0x08086428)                                 = 0
brk(0x08088428)                                 = 0
sysconfig(_CONFIG_PAGESIZE)                     = 4096
getcwd("/export/home/andrew", 1024)             = 0
chdir("/export/ims")                            = 0
getcwd("/export/ims", 1024)                     = 0
chdir("/export/home/andrew")                    = 0
pipe()                                          = 3 [4]
schedctl()                                      = 0xFEFBC000
fork1()                                         = 14813
lwp_sigmask(SIG_SETMASK, 0x00000000, 0x00000000) = 0xFFBFFEFF [0x0000FFFF]
fcntl(3, F_DUP2FD, 0x00000001)                  = 1
close(3)                                        = 0
close(4)                                        = 0
statvfs("/export/ims", 0x08085DB0)              Err#79 EOVERFLOW
/export/imswrite(2, " / e x p o r t / i m s", 11)               = 11
: write(2, " :  ", 2)                           = 2
Value too large for defined data typewrite(2, " V a l u e t o o l a".., 37) = 37
write(2, "\n", 1)                               = 1
close(1)                                        = 0
waitid(P_ALL, 0, 0x08047C50, WEXITED|WTRAPPED)  = 0
_exit(-1)

_______________________________________________
zfs-discuss mailing list
zfs-discuss@opensolaris.org
http://mail.opensolaris.org/mailman/listinfo/zfs-discuss
_______________________________________________
zfs-discuss mailing list
zfs-discuss@opensolaris.org
http://mail.opensolaris.org/mailman/listinfo/zfs-discuss

Reply via email to