howto monitor a program creating links in /tmp?

[Joachim Backes]

On 04/23/2010 12:29 PM, Jeff Raber wrote:
>> Anybody has an advice howto find out who is creating these links?
>>
>> Kind regards
>>
>
> Try using auditd.  Something like:
> 	sudo auditctl -w /some/file -k test-audit -p rwxa
> then later
> 	sudo ausearch -f /some/file
>
> -Jeff

Hi Jeff,

thank you very much for your hints. Using auditd gave me exactly the 
information I needed. The program creating the links was *gcm-apply*.

Kind regards

-- 
Joachim Backes <joachim.backes at rhrk.uni-kl.de>

http://www.rhrk.uni-kl.de/~backes

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 6131 bytes
Desc: S/MIME Cryptographic Signature
Url : http://lists.fedoraproject.org/pipermail/test/attachments/20100423/e4ac560a/attachment-0001.bin