Monitoring a file?

[Matthew Seaman]

On Sun, Nov 23, 2003 at 11:17:57AM +0100, Cordula's Web wrote:
> > >  A file, let's say, /path/to/a/file, is being modified by
> > >  an unknown process P(u) at random times. Unfortunately,
> > >  the name of the program ran by P(u) is unknown.
> > 
> > 	Have you tried moving the file elsewhere and seeing if anyone
> > complains about the absence?
> 
> No, P(u) obviously fails silently. There's nothing recorded
> by syslog, no messages on the console, and no core dumps...
> 
> > 	Or writing a program that locks the file?
> 
> That was a good idea. However, P(u) didn't seem to take a lock.
> Advisory locks are just that: if P(u) doesn't lock the file,
> existing locks don't matter at all. Do we have mandatory locks
> in FreeBSD?

Not a lock as such, but:

    # chflags schg /path/to/a/file

should achieve the effect you desire.  Although this will cause any
write on the file to just fail, rather than causing P(u) to block
waiting for a lock.  You could try replacing /path/to/a/file with a
fifo (see mkfifo(1)), and maybe hang another process on the other end
of the fifo which can run ps(1) or fstat(1) when a write is detected.

	Cheers,

	Matthew

-- 
Dr Matthew J Seaman MA, D.Phil.                       26 The Paddocks
                                                      Savill Way
PGP: http://www.infracaninophile.co.uk/pgpkey         Marlow
Tel: +44 1628 476614                                  Bucks., SL7 1TH UK
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-questions/attachments/20031123/e2b45d6a/attachment.bin