paperlined.org
rosetta_stone > os
document updated 5 months ago, on Sep 5, 2024

OS-wide monitoring (in Linux)

Ways to do something like strace, but for every process on a server.

files being changed

man inotifywait

Wikipedia — inotify

This watches file changes in one directory tree only, not the whole server. The larger the tree that you watch, the more likely you are to get the error message "upper limit on inotify watches reached".

files being accessed

fanotify provides a mechanism.

To check if your kernel supports fanotify: grep CONFIG_FANOTIFY /boot/config-$(uname -r)

processes being created

TCP connections being made

Ideally these tools would list the process ID (pid) of the process connected to that TCP connection.

general eBPF content