<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>4.2.6. Monitoring Changes to File Attributes</title><link rel="stylesheet" href="./Common_Content/css/default.css" type="text/css" /><meta name="generator" content="publican 1.6" /><meta name="package" content="Systemtap-SystemTap_Beginners_Guide-1.0-en-US-2.0-2" /><link rel="home" href="index.html" title="SystemTap Beginners Guide" /><link rel="up" href="mainsect-disk.html" title="4.2. Disk" /><link rel="prev" href="inodewatchsect.html" title="4.2.5. Monitoring Reads and Writes to a File" /><link rel="next" href="ioblktimesect.html" title="4.2.7. Periodically Print I/O Block Time" /></head><body class=""><p id="title"><a class="left" href="http://www.fedoraproject.org"><img src="Common_Content/images/image_left.png" alt="Product Site" /></a><a class="right" href="http://docs.fedoraproject.org"><img src="Common_Content/images/image_right.png" alt="Documentation Site" /></a></p><ul class="docnav"><li class="previous"><a accesskey="p" href="inodewatchsect.html"><strong>Prev</strong></a></li><li class="next"><a accesskey="n" href="ioblktimesect.html"><strong>Next</strong></a></li></ul><div xml:lang="en-US" class="section" title="4.2.6. Monitoring Changes to File Attributes" lang="en-US"><div class="titlepage"><div><div><h3 class="title" id="inodewatch2sect">4.2.6. Monitoring Changes to File Attributes</h3></div></div></div><a id="id3052121" class="indexterm"></a><a id="id2939141" class="indexterm"></a><a id="id2953349" class="indexterm"></a><a id="id3070602" class="indexterm"></a><a id="id3069921" class="indexterm"></a><div class="para">
This section describes how to monitor if any processes are changing the attributes of a targeted file, in real time.
</div><div class="formalpara"><h5 class="formalpara" id="inodewatch2">inodewatch2-simple.stp</h5>
<pre class="programlisting">
global ATTR_MODE = 1
probe kernel.function("inode_setattr") {
dev_nr = $inode->i_sb->s_dev
inode_nr = $inode->i_ino
if (dev_nr == ($1 << 20 | $2) # major/minor device
&& inode_nr == $3
&& $attr->ia_valid & ATTR_MODE)
printf ("%s(%d) %s 0x%x/%u %o %d\n",
execname(), pid(), probefunc(), dev_nr, inode_nr, $attr->ia_mode, uid())
}
</pre>
</div><div class="para">
Like <a class="xref" href="inodewatchsect.html#inodewatch" title="inodewatch-simple.stp">inodewatch-simple.stp</a> from <a class="xref" href="inodewatchsect.html" title="4.2.5. Monitoring Reads and Writes to a File">Section 4.2.5, “Monitoring Reads and Writes to a File”</a>, <a class="xref" href="inodewatch2sect.html#inodewatch2" title="inodewatch2-simple.stp">inodewatch2-simple.stp</a> takes the targeted file's device number (in integer format) and <code class="command">inode</code> number as arguments. For more information on how to retrieve this information, refer to <a class="xref" href="inodewatchsect.html" title="4.2.5. Monitoring Reads and Writes to a File">Section 4.2.5, “Monitoring Reads and Writes to a File”</a>.
</div><div class="para">
The output for <a class="xref" href="inodewatch2sect.html#inodewatch2" title="inodewatch2-simple.stp">inodewatch2-simple.stp</a> is similar to that of <a class="xref" href="inodewatchsect.html#inodewatch" title="inodewatch-simple.stp">inodewatch-simple.stp</a>, except that <a class="xref" href="inodewatch2sect.html#inodewatch2" title="inodewatch2-simple.stp">inodewatch2-simple.stp</a> also contains the attribute changes to the monitored file, as well as the ID of the user responsible (<code class="command">uid()</code>). <a class="xref" href="inodewatch2sect.html#inodewatch2output" title="Example 4.11. inodewatch2-simple.stp Sample Output">Example 4.11, “inodewatch2-simple.stp Sample Output”</a> contains shows the output of <a class="xref" href="inodewatch2sect.html#inodewatch2" title="inodewatch2-simple.stp">inodewatch2-simple.stp</a> while monitoring <code class="filename">/home/joe/bigfile</code> when user <code class="computeroutput">joe</code> executes <code class="command">chmod 777 /home/joe/bigfile</code> and <code class="command">chmod 666 /home/joe/bigfile</code>.
</div><div class="example" id="inodewatch2output"><div class="example-contents"><pre class="screen">
chmod(17448) inode_setattr 0x800005/6011835 100777 500
chmod(17449) inode_setattr 0x800005/6011835 100666 500
</pre></div><h6>Example 4.11. <a class="xref" href="inodewatch2sect.html#inodewatch2" title="inodewatch2-simple.stp">inodewatch2-simple.stp</a> Sample Output</h6></div><br class="example-break" /></div><ul class="docnav"><li class="previous"><a accesskey="p" href="inodewatchsect.html"><strong>Prev</strong>4.2.5. Monitoring Reads and Writes to a File</a></li><li class="up"><a accesskey="u" href="#"><strong>Up</strong></a></li><li class="home"><a accesskey="h" href="index.html"><strong>Home</strong></a></li><li class="next"><a accesskey="n" href="ioblktimesect.html"><strong>Next</strong>4.2.7. Periodically Print I/O Block Time</a></li></ul></body></html>
