loggedfs for Debian
---------------

Loggedfs can be run from the shell or in daemon mode. For the daemon mode,
there is an additional init script in /etc/init.d/loggedfs, configured to not
start the daemon by default

Reasonable default values are provided in /etc/default/loggedfs. You can
control the behavior of the loggedfs daemon by configuring this file directly,
or by using medium priority at install/configure time. There, debconf will ask
you some questions to configure it.

 Beware though - logging essential paths of your fs like those directly
under / or /home/user is strongly discouraged. When launching/stopping
loggedfs daemon, every process in it has to release those parts of the fs
and take them back again, otherwise the node connection will be lost and all
changes you make afterwards will not be taken into account. So you may have
to reboot to ensure everything's ok.
In a nutshell, it is strongly advised to audit only subdirectories of
/home/user like /home/user/foo.

The internal loggedfs configuration file is available at /etc/loggedfs.xml.
There, you can specify some parameters such as which fs operations you want
to log (such as getattr, open, write…) or which user you want to audit.

Finally, note that you can also use loggedfs in non daemon mode. You can
directly run it from a shell to log other paths, information… 'man loggedfs'
for more info.


 -- Didier Roche <didrocks@ubuntu.com>  Mon, 12 Jan 2009 21:21:12 +0100
