Hello group,

Is it possible to monitor a binary for who used it and when?
I am thinking about a deamon able to monitor some binaries and log the information.

Anyone with an idea about a tool with such capabilities?

Thanks in advance,
Bernard

Search for "Logging File Accesses" in this group, you'll see it was
possible in 1996.
And it's still possible today!

See
http://publib16.boulder.ibm.com/doc_...g_overview.htm.

You can also buy another product if you really want to.
Something like Etrust Access Control (formerly Seos) for example.

Regards,
JN.

Thanks,
I found my answer in the auditing subsystem. That will do the job.

Regards,
Bern

jeannimov@imel.org wrote:

try strace -p -v pid.
This would show you all the internal system calls.

good luck

if you're looking to do this on a regular basis and have reports of
changes to your filesystems, i'd recommend tripwire. its free and
reliable, as far as i can tell... useful for post-break in forensics too..

-neal

Bern wrote: