system/loggedfs/README



loggedfs (filesystem monitoring with FUSE)

LoggedFS is a fuse-based filesystem which can log every operation that
happens in it. LoggedFS only sends a message to syslog (or a file)
when called by fuse and then lets the real filesystem do the rest of
the job.

There is a sample config file installed as /etc/loggedfs.xml, for use
with the -c option.

Note: loggedfs doesn't cross filesystem boundaries. If you e.g. have
/usr/local mounted as a separate partition, monitoring /usr won't
also monitor /usr/local (though you can always run another instance of
loggedfs in that case).

Slackware note: since Slackware's /etc/mtab is a regular file (not
a symlink to /proc/mounts), killing a loggedfs process causes its
/etc/mtab entry to stay. This makes it look like the filesystem is
still mounted, though it actually isn't. To avoid this, always use
"fusermount -u" to cleanly umount the fs, which will also make the
loggedfs process exit.