rfsdelta is a kernel module for the Linux 2.6 series that collects all filesystem inode changes (recursively) and reports them to a userspace process.
It is similar to inotify, dnotify (but provides recursive notification, and only a single watcher process is allowed), fschange, fsevent, and rlocate (but also reports unlink(), rmdir(), and st_*).
This project was based on the kernel module shipped with rlocate 0.5.5.
Limitations:
· Only one watch per system: the 2nd attempt to open rfsdelta-events will give `Device or resource busy'.
· Doesn't work with rlocate.ko or any other security module (registered with register_security()). A subsequent call to register_security will yield `Invalid parameters'. (This shouldn't be hard to fix provided that rlocate.ko is the first security module to be loaded.)
How to compile and install
You need a Linux 2.6 kernel source tree, and a kernel with these settings:
CONFIG_MODULES=y
CONFIG_SECURITY=y
CONFIG_SECURITY_CAPABILITES: disabled or module (=m)
In the folder containing `rfsdelta', run
$ make
This has built the rfsdelta.ko kernel module.
As root, run this to try:
# insmod rfsdelta.ko
# cat /proc/rfsdelta
# rmmod rfsdelta
As root, run these to install:
# make install
# modprobe rfsdelta
To try it, as root start
# tr ' 00' 'n'
You can change a couple of settings in /proc/rfsdelta. Run this command
as root:
# echo '< key >:< value >' >/proc/rfsdelta
What's New in This Release:
· Some in-kernel locking and synchronization issues were fixed. log_writes support (i.e. reporting changes of file contents) was added.
Product's homepage
Find us on Google+
