Question: tracking filesystem changes?

[Marco Molteni]

Deomid Ryabkov wrote:

[..]

> E.g., if an unlink call is issued and an inode is within a particular 
> filesystem (luckily, most of our data
> already lives on or can be easily moved to a separate filesystem), a 
> notice is sent to some userland daemon:
> "file /www/xxx/yyy.shtml is unlinked". Or opened for writing, or 
> renamed... etc.
> The file is then scheduled for distribution to mirrors.
> The idea seems simple and straightforward, yet I don't know if it is 
> achievable.
> 
> The essential part is obtaining the full pathname of the file (won't 
> bother with hardlinks at first, they aren't used here).
> Could that be done with the FreeBSD's filesystem (vnode/vfs?) code? 
> (which I'm not familiar with)

yet another suggestion: ;-)

what about a shared library shim? That is, you use LD_PRELOAD and
intercept calls to the system calls you are interested in. This trick
is also called interposing.

say your executable calls open(). The shim intercepts open(), does its
logging/triggering/whatever, calls the real syscall and returns. It is
just a wrapper.

This is user-level, but works also with executables for which you don't
have source code, they just have to be dynamically linked against libc.

marco