SEO

#1 (**permalink**) 01-05-2008, 05:47 AM

Hello group,

Is it possible to monitor a binary for who used it and when?
I am thinking about a deamon able to monitor some binaries and log the information.

Anyone with an idea about a tool with such capabilities?

Thanks in advance,
Bernard

#2 (**permalink**) 01-05-2008, 05:47 AM

Search for "Logging File Accesses" in this group, you'll see it was
possible in 1996.
And it's still possible today!

See
http://publib16.boulder.ibm.com/doc_...g_overview.htm.

You can also buy another product if you really want to.
Something like Etrust Access Control (formerly Seos) for example.

Regards,
JN.

#3 (**permalink**) 01-05-2008, 05:47 AM

Thanks,
I found my answer in the auditing subsystem. That will do the job.

Regards,
Bern

jeannimov@imel.org wrote:
> Search for "Logging File Accesses" in this group, you'll see it was
> possible in 1996.
> And it's still possible today!
>
> See
>
http://publib16.boulder.ibm.com/doc_...g_overview.htm.
>
> You can also buy another product if you really want to.
> Something like Etrust Access Control (formerly Seos) for example.
>
> Regards,
> JN.

#4 (**permalink**) 01-05-2008, 05:48 AM

try strace -p -v pid.
This would show you all the internal system calls.

good luck

#5 (**permalink**) 01-05-2008, 05:59 AM

if you're looking to do this on a regular basis and have reports of
changes to your filesystems, i'd recommend tripwire. its free and
reliable, as far as i can tell... useful for post-break in forensics too..

-neal

Bern wrote:
> Hello group,
>
> Is it possible to monitor a binary for who used it and when?
> I am thinking about a deamon able to monitor some binaries and log the information.
>
> Anyone with an idea about a tool with such capabilities?
>
> Thanks in advance,
> Bernard

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

SEO

Monitoring a binary