News for hackers. Stuff that matters.

A comment on Show HN: FSQL – Search through your file system with SQL-esque queries. Parent comment

Re:Show HN: FSQL – Search through your file system with SQL-... by bpchaps on Monday May 15, 2017 @11:45PM (#14347235)
Definitely crossed my mind, but I'm working on hosts where installing auditd isn't really easy. Broken yum and apt all over the place makes installing new packages almost impossible. Same goes for lsof, but its installed in "enough" places. Kinda nightmarish, but it gives me a chance to write some fun code ;).

Also, thanks for the article! Super interesting. Think that'd be better than implementing something on top of sysdig?

[ Parent | on HN ]
Re:Show HN: FSQL – Search through your file system with SQL-... by tyingq on Tuesday May 16, 2017 @12:19AM (#14347323)
Auditd has the advantage of not being intermittent polling, which could miss something. Sounds like it isn't an option though.
[ Parent | on HN ]
Re:Show HN: FSQL – Search through your file system with SQL-... by tyingq on Tuesday May 16, 2017 @08:51AM (#14349126)
Another non polling option: http://www.brendangregg.com/blog/2014-07-25/opensnoop-for-li...
[ Parent | on HN ]
Re:Show HN: FSQL – Search through your file system with SQL-... by bpchaps on Tuesday May 16, 2017 @02:48PM (#14352193)
+1 for anything by Brendan Gregg.

I wasn't aware of the polling limitations of sysdig, but it definitely explains some things I've seen in the past. This is definitely going in my toolkit. Cheers!

Edit: dammit, spelled his name wrong.

[ Parent | on HN ]