[Gllug] stat'ing a file shows it was changed today and yet it has the date of a few days ago

[John Edwards]

On Mon, Jun 20, 2011 at 10:57:05PM +0100, John Hearns wrote:
> On 20 June 2011 22:48, Nix <nix at esperi.org.uk> wrote:
<snip> 
>> No, this is not recorded anywhere (except if you have utterly insane
>> auditing of some kind turned on).
> 
> You've hit a bit nail on the head here!
<snip> 
> My point really being that users are baffled why I can tell what
> happened at 13 seconds pst midnight on June 13th, but can't tell when
> that file was created.

Well usually systems log failures or significant events instead of
successes. For most people the creation of a file is a success, and
is too insignificant and common to log.

There is a strange little hack called snoopy, which a preload shared
library that wraps calls to execve() and effectively allows you to
log all commands being run on a machine:
	http://sourceforge.net/projects/snoopylogger/

It got dropped in the current stable version of Debian when it was
unmaintained, but is now being maintained again back and in sid:
	http://packages.debian.org/sid/snoopy


And I think the whole modify/change time confusing everyone who meets
it, especially when the behaviour changes across different filesystems.

Usually modify = contents modified, and change = status changed.
'man 2 stat' has lots more details.


-- 
#---------------------------------------------------------#
|    John Edwards   Email: john at cornerstonelinux.co.uk    |
#---------------------------------------------------------#
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 205 bytes
Desc: Digital signature
URL: <http://mailman.lug.org.uk/pipermail/gllug/attachments/20110621/edeb0a3b/attachment.pgp>
-------------- next part --------------
--
Gllug mailing list  -  Gllug at gllug.org.uk
http://lists.gllug.org.uk/mailman/listinfo/gllug