topic Re: monitoring file access in Operating System - HP-UX

monitoring file access

Marco Salvi — Tue, 06 Sep 2005 07:28:40 GMT

Anyone know how to monitoring what process access a file?
I tried with fuser but it doesn't fit my need.
I need some utility that create a list of the all process that have accessed a specific file.

Re: monitoring file access

Victor BERRIDGE — Tue, 06 Sep 2005 07:40:54 GMT

Hi,
What about lsof then, if you dont have it you will have to go to your prefered porting archive center and download the product...

All the best
Victor

Re: monitoring file access

Mahesh Kumar Malik — Tue, 06 Sep 2005 07:41:41 GMT

Hi Marco"

"lsof" a contributory utility may be of help to you. Please visit following link for download

http://hpux.connect.org.uk/hppd/hpux/Sysadmin/lsof-4.76/

Regards
Mahesh

Re: monitoring file access

Steven E. Protter — Tue, 06 Sep 2005 07:43:04 GMT

finding this out is a multi step operation.

fuser -cu /filesystem

can show open processes on a filesystem.

lsof can provide data on processes and is pretty useful.

But all processes that have accessed a specific file? Maybe if the system was trusted, you could set up auditing reports to do that for you.

HIDS/9000 comes to mind, but I'm not sure either is the right tool for this job.

SEP

Re: monitoring file access

Vibhor Kumar Agarwal — Tue, 06 Sep 2005 07:43:57 GMT

A file doesn't have any indication of what processed accessed it in the past.

You can get the no. of processed accessing it at a particular snapshot.

Or simply run a script via cron which appends that to a log.

Re: monitoring file access

RAC_1 — Tue, 06 Sep 2005 07:44:03 GMT

lsof will give details about open files hold by a process. Once process is completed, you won't get any details.

Get lsof from following.

http://hpux.connect.org.uk

Re: monitoring file access

Jannik — Tue, 06 Sep 2005 07:46:23 GMT

the lsof is the best choise:
http://ftp.cerias.purdue.edu/pub/tools/unix/sysutils/lsof/binaries/hpux/
use this download it works!

Re: monitoring file access

Alessandro Pilati — Tue, 06 Sep 2005 07:50:33 GMT

Marco,
here you can download directly the binaries of lsof:

http://www.mirrors.wiretapped.net/security/host-security/lsof/binaries/hpux/

Ciao,
Alessandro

Re: monitoring file access

Alessandro Pilati — Tue, 06 Sep 2005 07:52:07 GMT

Here you have a lot of Faq and answers about lsof:
http://www.mirrors.wiretapped.net/security/host-security/lsof/FAQ

Regards,
Alessandro

Re: monitoring file access

Marco Salvi — Tue, 06 Sep 2005 08:49:54 GMT

Thanks a lot for the answers, anyway lsof doesn't help me.
lsof can't report when a file is opened by the vi editor, so all the processes that have a behaviour similar to vi are not be catched by lsof.

Re: monitoring file access

Srimalik — Sun, 02 Dec 2007 14:58:24 GMT

I am not sure if this will be acceptable to u but anyways:

you can try HIDS( Host intrusion detection system).
create rules on the filename.

Re: monitoring file access

Srimalik — Sun, 02 Dec 2007 14:59:28 GMT

oops this thread is 2 yrs old.