Is it possible to log every access to disk/directory?

Take a look at inotify, that's pretty much exactly what it's built for. IBM have a half-decent introduction (though somewhat out of date) at http://www.ibm.com/developerworks/linux/library/l-inotify.html


If it's to monitor the actions of a single program strace with a simple filter script is what you want, more generally look at SElinux's "auditd".

http://en.wikipedia.org/wiki/Strace http://linux.die.net/man/8/auditd

On the windows side look at filemon from the SysInternals guys.

http://technet.microsoft.com/en-us/sysinternals/bb896642.aspx


You can use incron, which is a cron-like tool for filesystem events from inotify.

You can define an action to be executed everytime IN_ACCESS event occur.

Configuration is as easy as cron:

<path> <mask> <command>

Where:

  • <path> is a filesystem path (each whitespace must be prepended by a backslash)
  • <mask> is a symbolic (see inotify.h; use commas for separating symbols) or numeric mask for events
  • <command> is an application or script to run on the events