home *** CD-ROM | disk | FTP | other *** search
Wrap
IIIIMMMMOOOONNNN((((7777MMMM)))) IIIIMMMMOOOONNNN((((7777MMMM)))) NNNNAAAAMMMMEEEE imon - inode monitor device SSSSYYYYNNNNOOOOPPPPSSSSIIIISSSS ####iiiinnnncccclllluuuuddddeeee <<<<ssssyyyyssss////iiiimmmmoooonnnn....hhhh>>>> ////ddddeeeevvvv////iiiimmmmoooonnnn DDDDEEEESSSSCCCCRRRRIIIIPPPPTTTTIIIIOOOONNNN The inode monitor driver is a pseudo device driver which enables a user level program to monitor filesystem activity on a file by file basis. The application program expresses interest in specific files by means of an _i_o_c_t_l request that specifies the pathname of the file and an indication of what types of events are to be monitored. As various actions take place on a file in which interest has been expressed, _i_m_o_n posts events through a queue that may be read via the _r_e_a_d system call. EEEEvvvveeeennnnttttssss Calls to _r_e_a_d return an integral number of imon queue elements. Each queue element has the structure given below. typedef struct { ino_t qe_inode; /* inode number of file */ dev_t qe_dev; /* device of file */ intmask_t qe_what; /* what events occurred */ } qelem_t; The qqqqeeee____iiiinnnnooooddddeeee is a key that uniquely describes every file within a filesystem and matches the sssstttt____iiiinnnnoooo field of the file's _s_t_a_t structure (see _s_t_a_t(4) ). The qqqqeeee____ddddeeeevvvv field similarly matches the st_dev field of the file's _s_t_a_t structure. These two fields together uniquely describe a file in the system. The third field, qqqqeeee____wwwwhhhhaaaatttt, contains a bit-mask describing what event or events took place on that file. The possible events are: IIIIMMMMOOOONNNN____CCCCOOOONNNNTTTTEEEENNNNTTTT The contents or size of the file have changed. This is typically caused by a _w_r_i_t_e(2) call made by some process. IIIIMMMMOOOONNNN____AAAATTTTTTTTRRRRIIIIBBBBUUUUTTTTEEEE The mode or ownership have changed on the file. This is typically caused by a _c_h_o_w_n(2) or _c_h_m_o_d(2) system call. IIIIMMMMOOOONNNN____DDDDEEEELLLLEEEETTTTEEEE The last link to the file has gone away. When this event is sent, all interest in the file is implicitly revoked. Note that if a process has the file open when it is removed from the directory structure, this event will not be generated until the file is closed. IIIIMMMMOOOONNNN____EEEEXXXXEEEECCCC The file represents an executable command and a process has started executing that command. If multiple instances of the same command are subsequently started, an event is not generated. Therefore, the IIIIMMMMOOOONNNN____EEEEXXXXEEEECCCC event only means that at least one process is executing from that file. When an interpreted executable (see_e_x_e_c_v_e(2)) is executed, PPPPaaaaggggeeee 1111 IIIIMMMMOOOONNNN((((7777MMMM)))) IIIIMMMMOOOONNNN((((7777MMMM)))) then IMON_EXEC events are generated both for the interpreted script and for the interpreter. IIIIMMMMOOOONNNN____EEEEXXXXIIIITTTT The last process executing the file has exited. IIIIMMMMOOOONNNN____OOOOVVVVEEEERRRR The _i_m_o_n event queue has overflowed. When this occurs, the client process must re-express interest in each file to determine its true state. CCCCoooonnnnttttrrrroooollllssss The following structure is used by the IIIIMMMMOOOONNNNIIIIOOOOCCCC____EEEEXXXXPPPPRRRREEEESSSSSSSS and IIIIMMMMOOOONNNNIIIIOOOOCCCC____RRRREEEEVVVVOOOOKKKKEEEE controls described below. typedef struct { char * in_fname; /* pathname */ struct stat * in_sb; /* optional status return buffer */ intmask_t in_what; /* what types of events to send */ } interest_t; IIIIMMMMOOOONNNNIIIIOOOOCCCC____EEEEXXXXPPPPRRRREEEESSSSSSSS Express interest in the file whose name is given in iiiinnnn____ffffnnnnaaaammmmeeee. If iiiinnnn____ffffnnnnaaaammmmeeee represents a symbolic link, the action takes place on the link itself, not the file to which it points. Only events in the bit-mask iiiinnnn____wwwwhhhhaaaatttt will be generated. The iiiinnnn____ssssbbbb field optionally points to a _s_t_a_t(4) buffer that will be filled in with the current state of the file. This allows the _i_m_o_n client to atomicly express interest and get the current state of a file. Multiple calls may be made on the same file and have a cumulative effect. IIIIMMMMOOOONNNNIIIIOOOOCCCC____RRRREEEEVVVVOOOOKKKKEEEE Revoke interest in the file whose name is given by iiiinnnn____ffffnnnnaaaammmmeeee. The iiiinnnn____wwwwhhhhaaaatttt field is used to determine which interests will be revoked. As with IIIIMMMMOOOONNNNIIIIOOOOCCCC____EEEEXXXXPPPPRRRREEEESSSSSSSS, multiple calls may be made on the same file and have a cumulative effect. IIIIMMMMOOOONNNNIIIIOOOOCCCC____QQQQTTTTEEEESSSSTTTT Returns the number of events waiting to be read in the event queue. BBBBUUUUGGGGSSSS Files in an NFS mounted filesystem will only generate events for things that happen as a result of local activity; changes made remotely on the NFS server will not be seen through _i_m_o_n. CCCCAAAAVVVVEEEEAAAATTTTSSSS The _i_m_o_n driver is intended to be used only by the file access monitoring daemon (fam) and the interface is likely to change in future releases. Client programs should communicate with fam for monitoring services, not with _i_m_o_n directly. PPPPaaaaggggeeee 2222