e4rat-collect(8)

E4RAT-COLLECT(8)

User Manuals

E4RAT-COLLECT(8)

NAME

e4rat-collect - Generate a list of relevant files by monitoring applications

SYNOPSIS

e4rat-collect [ option(s) ] [ application name(s) ]

DESCRIPTION

e4rat-collect listens to the Linux audit socket to monitor filesystem activities and generates a list of relevant files retaining their access order. Temporary files or files opened with write access, like log-files, are excluded automatically.

You can either monitor applications or the entire operating system. If an application name is supplied, the processes to monitor are selected according to their process name, which is usually the name of the running executable and shown by the ps(1) command. Paths are removed from the process names. The application you specify are just monitored and does not get executed. To execute a command see --execute.

In addition, the collector follows child processes, which allows to monitor shell scripts correctly.

To stop scanning process press STR-C or run `e4rat-collect --stop'. Unless otherwise stated, the generated file list is written to './e4rat-collect.log'.

OPTIONS

Some options require a path to a file, directory or device. Feel free to use relative paths and or paths containing wildcard characters like '*' or '?'.

-V --version: show version information and exit.
-h --help: display usage message and exit.
-v --verbose: increment verbosity level.
-q --quiet: set verbose level to 0. This means that no messages will be displayed.
-l --loglevel <number>: set loglevel mask to <number>. All log messages are sent either to the Kernel log (see dmesg(1)) or to syslog(3).
-k --stop: kill already running e4rat-collect process
-x --execute <command>: collect while executing command. e4rat-collect stops running after <command> terminates. Be aware that <command> gets executed with root privileges if no username is specified. See --user.
-u --user <username>: specify username the command gets executed. See --execute.
-o --output [file]: set the output file in which the generated file list is written to. If no path is specified, the list is written to stdout.
-d --device <dev>
-D --exclude-device <dev>: limit monitoring to a special device. <dev> is a path to device normally in /dev. [example: /dev/sda1]
-p --path <path>
-P --exclude-path <path>: limit monitoring to a special path. [example: '*/bin/*']
-L --exclude-list <file>: The <file> contains a list of files, which e4rat-collect should exclude.
-e --watch-ext4 [true|false]: select whether e4rat-collect is limited to devices formatted with the ext4 filesystem. [Default: true]
-O --exclude-of [true|false]: select true or false whether e4rat-collect should ignore already opened files before start monitoring. [Default: true]

EXAMPLES

Scan Thunderbird and a locally running Imap daemon

Run collector as root:

    ~# sudo e4rat-collect thunderbird imapd

Once collector is running execute thunderbird as a normal user:

    ~# thunderbird

Alternatively combine it to one call

    ~# sudo e4rat-collect thunderbird imapd --execute 'thunderbird' --user `whoami`

Scan boot process:

Run e4rat-collect as early as possible to scan the whole startup process. It is recommended to run e4rat-collect as init process. To do so, add the following lines to the Kernel parameters in grub(8) or lilo(8).
init=/sbin/e4rat-collect

FILES

/etc/e4rat.conf
E4rat configuration file.

AUTHOR

Written by Andreas Rid and Gundolf Kiefer.

REPORTING BUGS

Report bugs to Andreas Rid <conso at users.sf.net>.