When a user connects a PC to a USB memory or SD card and puts in or takes out data I want to log. I also want to prevent users from dropping the monitoring process without permission.
Install inotify-tools
sudo apt-get install inotify-tools
qiita@ubuntu:~$ inotifywait -m .&
If the m option is not added, the command will end once it is output.
qiita@ubuntu:~$ ls
Desktop Documents Downloads Music
./ OPEN,ISDIR
./ ACCESS,ISDIR
./ CLOSE_NOWRITE,CLOSE,ISDIR
qiita@ubuntu:~$
qiita@ubuntu:~$
When I access the directory monitored by ls, something is displayed.
What about subdirectories
qiita@ubuntu:~$ mkdir hoge
./ CREATE,ISDIR hoge
qiita@ubuntu:~$ cd hoge
qiita@ubuntu:~/hoge$ ls
./ OPEN,ISDIR hoge
./ ACCESS,ISDIR hoge
./ ACCESS,ISDIR hoge
./ CLOSE_NOWRITE,CLOSE,ISDIR hoge
qiita@ubuntu:~/hoge$ mkdir hoge
qiita@ubuntu:~/hoge$ cd hoge
qiita@ubuntu:~/hoge/hoge$ ls
qiita@ubuntu:~/hoge/hoge$
Not monitored It seems that subdirectories are also monitored with the r option
qiita@ubuntu:~$ inotifywait -mr . &
[1] 2760
qiita@ubuntu:~$ Setting up watches. Beware: since -r was given,
this may take a while!
Watches established.
qiita@ubuntu:~$ cd hoge
qiita@ubuntu:~/hoge$ cd hoge
qiita@ubuntu:~/hoge/hoge$ ls
./hoge/ OPEN,ISDIR hoge
./hoge/hoge/ OPEN,ISDIR
./hoge/ ACCESS,ISDIR hoge
./hoge/hoge/ ACCESS,ISDIR
./hoge/ ACCESS,ISDIR hoge
./hoge/hoge/ ACCESS,ISDIR
./hoge/ CLOSE_NOWRITE,CLOSE,ISDIR hoge
./hoge/hoge/ CLOSE_NOWRITE,CLOSE,ISDIR
:%
By the way, I was running firefox while I was working,
.cache/mozilla/firefox/ It seems that writing is done from firefox under it, A lot of logs were being written out from notifywait. Even if I changed the user, the log was output when I accessed it.
What if I monitor the root directory?
qiita@ubuntu:~/hoge/hoge$ inotifywait -mr / &
[1] 2884
qiita@ubuntu:~/hoge/hoge$ Setting up watches.
Beware: since -r was given, this may take a while!
qiita@ubuntu:~/hoge/hoge$ Failed to watch /;
upper limit on inotify watches reached!
Please increase the amount of inotify watches allowed per user
via `/proc/sys/fs/inotify/max_user_watches'.
A lot of directories seem to be useless.
Monitor under / dev and monitor USB memory mount Monitor read / write to mounted directories Did you achieve the required purpose? Is it a daemon?
Monitor files and directories with inotify-tools [Linux] Execute arbitrary command when updating files using inotify wait
I wonder if I should monitor under / dev ...
Recommended Posts