How to count the number of times a file/directory has been opened?

Question

I'm trying to find the number of times a file has been opened (since the OS inception). I'm thinking of doing this via stat, but most flags only return the difference between the LAST time it was opened.

Answer 1

This answer explains what needs to be done, but the specifics of how depend on your distribution, your setup and purpose, and which tools you choose to parse the data:

What you are looking for is the Auditd daemon within Linux. From the manpage auditd(8):

auditd is the userspace component to the Linux Auditing System. It's responsible for writing audit records to the disk. Viewing the logs is done with the ausearch or aureport utilities. Configuring the audit rules is done with the auditctl utility. During startup, the rules in /etc/audit/audit.rules are read by auditctl and loaded into the kernel. Alterately, there is also an augenrules program that reads rules located in /etc/audit/rules.d/ and compiles them into an audit.rules file. The audit daemon itself has some configuration options that the admin may wish to customize. They are found in the auditd.conf file.

Auditing uses functions built into the kernel to create logs whenever certain system calls are made, per your specifications. Once setup, you will find the logs in /var/log/audit or somewhere similar per your distribution.

To audit access to a file, you would use something similar to:

auditctl -w /path/to/interesting/files/ -p rwxa -k myfileaudits

Where -w specifies the path to the files -p specifies that the system will audit reads writes, executions, and attribute or permission changes. Finally, the -k option allows you to specify an arbitrary key for use when searching for this rule with ausearch.

Note, that although auditd works off system calls, -p r does not track the read function, but rather open so that the logs aren't flooded with every read, but an entry is made everytime a file is opened for reading.

Once one has auditing turned on, and has the logs in place, ausearch can be used to parse these logs for all access to the specified files, and standard text or statistics tools can be used to generate the tallies. These can vary from grep and wc -l to count the log entries, or some combination of scripting and GNU-R or gnuplot to generate graphs and reports.

---

Another alternative is to use SELinux. While SELinux is a tool for access control that normally only logs access-denials, it can be setup to log ALL access, and provide similar information to auditd.

---

Edit: If a record of access is required from the beginning: for instance, during the OS installation, during boot prior to auditd starting, or prior to auditd installation, then more extreme measures are required. A custom installer or custom initrd.img boot file may need to be created in order to load the required debugger or kernel level tracing tools. These tracing tools could include dtrace, perf, SystemTap, ktap or similar debugger level tools to catch access during boot. A good reference is http://www.brendangregg.com/linuxperf.html and an example of this type of analysis for system performance, rather than auditing is bootchart.

Setting this up is beyond the scope of my experience however - hope the references prove useful.