Re:Show HN: FSQL – Search through your file system with SQL-...
by tyingq on Monday May 15, 2017 @09:10PM
(#14346645)
You could use the audit subsystem. https://www.linux.com/learn/customized-file-monitoring-audit...
Re:Show HN: FSQL – Search through your file system with SQL-...
by bpchaps on Monday May 15, 2017 @11:45PM
(#14347235)
Definitely crossed my mind, but I'm working on hosts where installing auditd isn't really easy. Broken yum and apt all over the place makes installing new packages almost impossible. Same goes for lsof, but its installed in "enough" places. Kinda nightmarish, but it gives me a chance to write some fun code ;).
Also, thanks for the article! Super interesting. Think that'd be better than implementing something on top of sysdig?
Re:Show HN: FSQL – Search through your file system with SQL-...
by tyingq on Tuesday May 16, 2017 @12:19AM
(#14347323)
Auditd has the advantage of not being intermittent polling, which could miss something. Sounds like it isn't an option though.
Re:Show HN: FSQL – Search through your file system with SQL-...
by tyingq on Tuesday May 16, 2017 @08:51AM
(#14349126)
Another non polling option: http://www.brendangregg.com/blog/2014-07-25/opensnoop-for-li...
Re:Show HN: FSQL – Search through your file system with SQL-...
by bpchaps on Tuesday May 16, 2017 @02:48PM
(#14352193)
+1 for anything by Brendan Gregg.
I wasn't aware of the polling limitations of sysdig, but it definitely explains some things I've seen in the past. This is definitely going in my toolkit. Cheers!
Edit: dammit, spelled his name wrong.
I'm specifically writing it to find any log file that isn't being pushed into our third party logging service. It's a surprisingly difficult problem, especially considering the amount of tech sprawl that's accumulated. Since it's also a relatively low latency environment, it has to be written in a way that doesn't add too much load (without core isolation..).