Re: rm logging

[Colin Watson <cjwatson@debian.org>]

On Fri, Nov 30, 2001 at 03:13:05PM +0100, DE SMAELE Kim (BMB) wrote:
> I am trying to setup an remove logging on a few of our sun E10K development
> servers.
> Is there any one of you who has an idea howto log every rm command  ( not in
> the syslog or with the sysdaemon if possible ).

You will have to recompile rm. You'll also almost certainly have to use
the syslog, because anything else would require either having a
world-writeable log file (rather pointless for this task) or a new
setuid/setgid program (bad idea).

I can't help thinking you're trying to solve the wrong problem. What
happens if somebody uses the unlink() system call, or if somebody just
truncates a file to zero length? You can't log everything unless you
want to hack the kernel and have a great deal of time to analyse log
files.

-- 
Colin Watson                                  [cjwatson@flatline.org.uk]