Monitor transactions on a file

[Fritz-Gerald: Zephir]

Is there a way to trap any kind of transaction on a file, wether it is accesssed or updated. If updated, is it possible to trap the modifications made?
I dont really care who did the modification, just what was modified. The file is not plain ASCII.

[Ricardo Bassoi]

Hi,

Two points:

If the file has been modified or updated you can use the find cmd:

#find / -name core -mtime +1

This cmd will find the core files that were modified in the last day.
You also can check this using a script to do the command su,, like this:

smp1:/> sum agenda.dat
61977 1 agenda.dat

If the file is modified the sum ( checksum )changes.

To check what was modified you can create a script to control the file size and save each day it contents to a backup file. To check what was modifies do a diff cmd:

diff filename filename.save

And you??ll have the modifications

Regards,


Bassoi

[PIYUSH D. PATEL]

Hi,

find / -name "filename" -mtime +days

Will tell you which files are modified or accessed within "days".

Well it will be difficult to see what is the difference unless the file is saved and then you can use diff.

Piyush

[Fritz-Gerald: Zephir]

Thanks for your replies. But what I'm really interested in is what were the modifications made.

Im looking more to :
At N position in file characters XXX are now YYYY.

One more point I might add is the fact that the file has a static size but the content changes

[Darrell Allen]

Hi,

There is a commercial product called Tripwire that monitors changes to files. That's about the extent of my knowledge of Tripwire.

In a quick search of the web I find references to AIDE - a free replacement for Tripwire. However I couldn't get web pages for it to load. Perhaps the site was down.

One last page:
http://cc.uoregon.edu/cnews/spring2001/tools.html

This refers to Tripwire, AIDE, and a Perl script, FCheck. I haven't checked it out but thought you may want to.

Darrell

[Fritz-Gerald: Zephir]

Could the use of FIFOS do the trick? I dont know much about them, but I think that I could have the writes would go to a fifo, I'd trap what I want then write it to the file