I'm trying to write a program that would gather statistics on filesystem
usage, over a long period of time.
I *think* the best way of doing this is to write a kernel module that
could replace some VFS functions, perhaps sys_write and the like, with
a function that writes a "what happened" message to a userspace program,
and then calls the original function.
Has something like this been done already ? If not, is it clean enough
to work ? If I wished to log just:
When a file is created/deleted/modified/read from
what's are the VFS functions of most use ? Can a module override functions
in the kernel proper ?
Kate
--
Microsoft - the best reason in the world to drink beer
