It happens a lot when you just wish if you be able to track file deletions and manipulations on your file system to know the root cause of a specific problem.
Imagine if you get this output on your log file:
[21/Feb/2009 11:21:18] IN_CREATE /tmp/services
[21/Feb/2009 11:21:18] IN_CLOSE_WRITE /tmp/services
[21/Feb/2009 11:21:18] * /tmp/services is closed
[21/Feb/2009 11:21:25] IN_DELETE /tmp/services
[21/Feb/2009 11:21:25] * /tmp/services is deleted
[21/Feb/2009 11:21:35] IN_CREATE /tmp/foo
[21/Feb/2009 11:21:35] IN_CLOSE_WRITE /tmp/foo
[21/Feb/2009 11:21:35] * /tmp/foo is closed
[21/Feb/2009 11:21:46] IN_DELETE /tmp/foo
[21/Feb/2009 11:21:46] * /tmp/foo is deleted
So how can you get that?
There is a Linux utility called iwatch that can be downloaded from this url:http://iwatch.sourceforge.net/index.html
You simply trigger the command by: $ iwatch -v /tmp
And you get the output above.
You can also have that send the output to your mailbox:
$ iwatch -v -m 2luqman@luqmanux.com /tmp
Thanks to matty, who posted this tip at his blog and I used it here using his article, read on the full article here: http://prefetch.net/blog/index.php/2009/02/28/monitoring-file-activity-on-linux-hosts/
Posts
