Real Time Change Event Detection System on Linux

Client:
A leading software product company, Portland, Oregon

Project Description :
The client needed a driver on Linux to capture any changes on the Linux file system i.e. creation, deletion, changes to the files or changes to the permissions on the file. A software product was needed that would continuously run in the background, monitor and report the system level events for auditing. There was external auditing agent to set the rules for monitoring the events.

There were following requirements for the Linux driver:
• Communicate with external auditing agent to get rules for change detection
• Capture Linux file system events
• Validate the captured events against the rules
• Report the validated events to external auditing agent
• Run on RHEL 3, 4, 5 Linux, with 32-bit as well as 64-bit OS
• The CPU usage of this driver during heavy file I/O not to exceed 5%
• Support SMP

Design Highlights:

Following are the design highlights of our solution:

• Layered architecture to ensure low coupling, high scalability and easy maintenance
• Development of Daemon that
• Registers with the kernel to receive file system change events
• Creates socket for communication
• Starts the IPC thread to handle external auditing agent request