inotifywait监控系列之一：对文件和目录访问进行记录

   1: [root@World77 ~]# inotifywait –m /root

   2: inotifywait: error while loading shared libraries: libinotifytools.so.0: cannot                                                                              open shared object file: No such file or directory

   1: [root@World77 ~]# find / -name libinotifytools.so.0

   2: /usr/local/lib/libinotifytools.so.0

   3: /root/inotify-tools-3.14/libinotifytools/src/.libs/libinotifytools.so.0

   4: [root@World77 ~]# cp /root/inotify-tools-3.14/libinotifytools/src/.libs/libinoti                                                                             fytools.so.0 /usr/lib

   5: [root@World77 ~]# cp /root/inotify-tools-3.14/libinotifytools/src/.libs/libinoti                                                                             fytools.so.0 /usr/local/lib/

   6: cp: overwrite `/usr/local/lib/libinotifytools.so.0'? y

   1: [root@World77 ~]# inotifywait -rm /root

   2: Setting up watches.  Beware: since -r was given, this may take a while!

   3: Watches established.

   4: /root/ OPEN .bash_profile

   5: /root/ ACCESS .bash_profile

   6: /root/ CLOSE_NOWRITE,CLOSE .bash_profile

   7: /root/ OPEN .bashrc

   8: /root/ ACCESS .bashrc

   9: /root/ CLOSE_NOWRITE,CLOSE .bashrc

  10: /root/ OPEN .bash_history

  11: /root/ ACCESS .bash_history

  12: /root/ CLOSE_NOWRITE,CLOSE .bash_history

  13: /root/ OPEN .bash_history

  14: /root/ ACCESS .bash_history

  15: /root/ CLOSE_NOWRITE,CLOSE .bash_history

  16: /root/ OPEN,ISDIR

  17: /root/ CLOSE_NOWRITE,CLOSE,ISDIR

  18: /root/ OPEN,ISDIR

  19: /root/ CLOSE_NOWRITE,CLOSE,ISDIR

  20: /root/ OPEN,ISDIR meinv

  21: /root/meinv/ OPEN,ISDIR

  22: /root/ CLOSE_NOWRITE,CLOSE,ISDIR meinv

  23: /root/meinv/ CLOSE_NOWRITE,CLOSE,ISDIR

  24: /root/ OPEN safe.sh

  25: /root/ ACCESS safe.sh

  26: /root/ MODIFY BlackIP.txt

  27: /root/ OPEN BlackIP.txt

  28: /root/ MODIFY BlackIP.txt

  29: /root/ CLOSE_WRITE,CLOSE BlackIP.txt

  30: /root/ ACCESS safe.sh

  31: /root/ OPEN BlackIP.txt

   1: inotifywait -rme modify,attrib,move,close_write,create,delete,delete_self > /root/test.txt