From 30300843e0c66ca3eefa97f5787f95b07c256d2f Mon Sep 17 00:00:00 2001 From: Epoch Qwert Date: Sun, 23 Nov 2014 14:25:42 -0600 Subject: fixed gitignore. >_> added a bunch of new piddly shit. --- src/bin/filemon.c | 72 +++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 72 insertions(+) create mode 100644 src/bin/filemon.c (limited to 'src/bin/filemon.c') diff --git a/src/bin/filemon.c b/src/bin/filemon.c new file mode 100644 index 0000000..6930673 --- /dev/null +++ b/src/bin/filemon.c @@ -0,0 +1,72 @@ +//ripped from the netbsd man page for kqueue +//and modified very slightly. +//I'll add some more stuff as I find a use for it. + #include + #include + #include + #include + #include + #include + #include + #include + + int + main(int argc, char *argv[]) + { + int fd, kq, nev; + struct kevent ev; + static const struct timespec tout = { 1, 0 }; + + if ((fd = open(argv[1], O_RDONLY)) == -1) + err(1, "Cannot open `%s'", argv[1]); + + if ((kq = kqueue()) == -1) + err(1, "Cannot create kqueue"); + + EV_SET(&ev, fd, EVFILT_VNODE, EV_ADD | EV_ENABLE | EV_CLEAR, + NOTE_DELETE|NOTE_WRITE|NOTE_EXTEND|NOTE_ATTRIB|NOTE_LINK| + NOTE_RENAME|NOTE_REVOKE, 0, 0); + if (kevent(kq, &ev, 1, NULL, 0, &tout) == -1) + err(1, "kevent"); + for (;;) { + nev = kevent(kq, NULL, 0, &ev, 1, &tout); + if (nev == -1) + err(1, "kevent"); + if (nev == 0) + continue; + if (ev.fflags & (NOTE_DELETE|NOTE_WRITE|NOTE_EXTEND|NOTE_ATTRIB|NOTE_LINK|NOTE_RENAME|NOTE_REVOKE)) { + printf("%s: ",argv[1]); + } + if (ev.fflags & NOTE_DELETE) { + printf("deleted "); + ev.fflags &= ~NOTE_DELETE; + } + if (ev.fflags & NOTE_WRITE) { + printf("written "); + ev.fflags &= ~NOTE_WRITE; + } + if (ev.fflags & NOTE_EXTEND) { + printf("extended "); + ev.fflags &= ~NOTE_EXTEND; + } + if (ev.fflags & NOTE_ATTRIB) { + printf("chmod/chown/utimes "); + ev.fflags &= ~NOTE_ATTRIB; + } + if (ev.fflags & NOTE_LINK) { + printf("hardlinked "); + ev.fflags &= ~NOTE_LINK; + } + if (ev.fflags & NOTE_RENAME) { + printf("renamed "); + ev.fflags &= ~NOTE_RENAME; + } + if (ev.fflags & NOTE_REVOKE) { + printf("revoked "); + ev.fflags &= ~NOTE_REVOKE; + } + printf("\n"); + if (ev.fflags) + warnx("unknown event 0x%x\n", ev.fflags); + } + } -- cgit v1.2.3