You could also try using strace as well, although maybe I just don't understand exactly what you need. Note; if the script doesn't run long enough it's hard to catch the data. For example when I ran dd below with a count of 1000 both text files were empty. I ran this as myself and root, the results were as expected.
#crontab.txt
* * * * * dd if=/dev/zero of=openfile bs=8k count=10000
* * * * * fuser openfile > fuser.txt
* * * * * lsof | grep openfile > lsof.txt
cat fuser.txt
2659
cat lsof.txt
dd 2659 $USER 1w REG 8,2 59416576 1060541 /home/$USER/openfile
On Tue, Mar 1, 2011 at 6:43 PM, Kurt Granroth
<kurt+plug-discuss@granroth.com> wrote:
I tried a script using incron last night and it implied that it was happening exactly when SpiderOak was starting up. I say "implied" because it effectively fork-bombed me (lesson learned: don't use IN_ALL_EVENTS) and my log file was all corrupted when I had to reboot.
On 3/1/11 9:19 AM, Dazed_75 wrote:
Given that you said "... corrupting or rewriting a critical file _just
before_ it runs", would it be worth renaming, removing or changing
permissions on the file just before that to see what fails or logs an error?
Larry
On Tue, Mar 1, 2011 at 8:14 AM, Alex Dean <alex@crackpot.org
<mailto:alex@crackpot.org>> wrote:
On Feb 28, 2011, at 5:33 PM, Kurt Granroth wrote:
> Maybe incron (cron version of inotify) could trigger a script
that runs 'stat' on the file. Still wouldn't give me the "who", though.
At first glance, I thought inotify would be perfect for this. But
(as you say) it doesn't appear that inotify events contain any
information about which process performed the change which trigged
the event.
struct inotify_event {
__s32 wd; /* watch descriptor */
__u32 mask; /* watch mask */
__u32 cookie; /* cookie to synchronize two events */
__u32 len; /* length (including nulls) of name */
char name[0]; /* stub for possible name */
};
http://www.linuxjournal.com/article/8478?page=0,1
There are some handy-looking tools in
https://github.com/rvoicilas/inotify-tools/wiki/. Seems like you
should be able to write a shell script to wait for a modification
event on your file, and run stat or lsof when the file is changed.
That's not perfect, since the modifying process might be done by
the time lsof actually runs, but it seems like it's worth a try.
alex
---------------------------------------------------
PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
<mailto:PLUG-discuss@lists.plug.phoenix.az.us>
To subscribe, unsubscribe, or to change your mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
--
Dazed_75 a.k.a. Larry
The spirit of resistance to government is so valuable on certain
occasions, that I wish it always to be kept alive.
- Thomas Jefferson
---------------------------------------------------
PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
To subscribe, unsubscribe, or to change your mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
---------------------------------------------------
PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
To subscribe, unsubscribe, or to change your mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss