Hello, i`d like to be able to trace filesystem access at early boot time, i.e to see what files being opened/closed on early boot (and later on). one possible way to do it is using nfs-root, so we can trace it at the network or server level - but how can this be done without using network filesystem ? i came across tracefs (http://www.filesystems.org/docs/tracefs-fast04/tracefs.pdf) which looks very promising, but it seems it`s not actively maintained. isn`t there a standard way to do that with recent kernels ? i searched for a while but didn`t find something appropriate.... regards Roland ps: this is also very interesting for intrusion detection - think of virtual machine`s filesystem activity being watched trough serial console (i.e. with nothing running in userspace and without hackers ability to disable it) ____________________________________________________________________ Psssst! Schon vom neuen WEB.DE MultiMessenger gehört? Der kann`s mit allen: http://www.produkte.web.de/messenger/?did=3123 -- To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
