serv001:~# cat ~irj/inotify.log.php
<?php
set_time_limit(0);
ini_set("display_errors", "on");
error_reporting(E_ALL);
ignore_user_abort(true);
// Recrusive found locations
$ret = array();
echo "Looking for www directoies\n";
getLocation($ret, "/home");
echo "Found ".sizeof($dir)." directoried...\nSetting watchs... Take a while...\n";
// Run...
$count = 1;
$wd2path = array();
$fd = inotify_init();
foreach ($ret as $domain => $path) {
echo "Setting watch for domain {$domain} ( {$path} )...";
addWatchs($fd, $path);
echo " sets ({$count}), memory usage ".memory_get_usage()." bytes \n";
}
echo "allready sets {$count} nodes\n";
echo "Watching...\n";
while (true) {
$events = inotify_read($fd);
//print_r($events);
foreach ($events as $event) {
clearstatcache();
//echo "* Event: (wd: {$event['wd']}, mask: {$event['mask']} ({$masks[$event['mask']]}), cookie: {$event['cookie']}, filename: {$event['name']}, path {$wd2path[$event['wd']]}\n";
//echo "* Event: cookie: {$event['cookie']}, filename: {$event['name']}, path {$wd2path[$event['wd']]}\n";
$mask = $event['mask'];
if ($mask & IN_ISDIR) {
if ($mask & IN_CREATE) {
$tmp = inotify_add_watch($fd, $wd2path[$event['wd']]."/".$event['name'],
IN_MODIFY | IN_MOVED_FROM | IN_MOVED_TO | IN_CREATE | IN_DELETE | IN_DELETE_SELF | IN_MOVE_SELF);
$wd2path[$tmp] = $wd2path[$event['wd']]."/".$event['name'];
$count++;
}
if ($mask & IN_IGNORED) {
inotify_rm_watch($fp, $event['wd']);
unset($wd2path[$event['wd']]);
}
}
if (!($mask & IN_ISDIR) && !preg_match("/\.htaccess|\.php|\.phtml|\.sh$/i", $event['name'])) {
// skip event
continue;
}
if (!($mask & IN_ISDIR) && (
preg_match("/^sql_/", $event['name']) ||
$event['name'] == "drop.php"
)) {
continue;
}
$fId = fopen("/root/inotify/".date("Y-m-d").".log", "a+");
fputs($fId,
"[".date("H:i:s")."] {$wd2path[$event['wd']]}/{$event['name']} ".($mask & IN_ISDIR ? "D\n" : "F\n"));
if ($mask & IN_ACCESS) fputs($fId, "- File was accessed (read)\n");
if ($mask & IN_MODIFY) fputs($fId, "- File was modified\n");
if ($mask & IN_ATTRIB) fputs($fId, "- Metadata changed (e.g. permissions, mtime, etc.)\n");
if ($mask & IN_CLOSE_WRITE) fputs($fId, "- File opened for writing was closed\n");
if ($mask & IN_CLOSE_NOWRITE) fputs($fId, "- File not opened for writing was closed\n");
if ($mask & IN_OPEN) fputs($fId, "- File not opened for writing was closed\n");
if ($mask & IN_MOVED_TO) fputs($fId, "- File or directory was moved to\n");
if ($mask & IN_MOVED_FROM) fputs($fId, "- File moved out of watched directory\n");
if ($mask & IN_CREATE) fputs($fId, "- File or directory created in watched directory\n");
if ($mask & IN_DELETE) fputs($fId, "- Watched file or directory was deleted\n");
if ($mask & IN_MOVE_SELF) fputs($fId, "- Watch file or directory was moved self\n");
if ($mask & IN_CLOSE) fputs($fId, "- Equals to IN_CLOSE_WRITE | IN_CLOSE_NOWRITE\n");
if ($mask & IN_MOVE) fputs($fId, "- Equals to IN_MOVED_FROM | IN_MOVED_TO\n");
// if ($mask & IN_ALL_EVENTS) echo "- Bitmask of all the above constants";
if ($mask & IN_UNMOUNT) fputs($fId, "- File system containing watched object was unmounted\n");
if ($mask & IN_Q_OVERFLOW) fputs($fId, "- Event queue overflowed (wd is -1 for this event)\n");
if ($mask & IN_IGNORED) fputs($fId, "- Watch was removed (explicitly by inotify_rm_watch() or because file was removed or filesystem unmounted\n");
if ($mask & IN_ISDIR) fputs($fId, "- Subject of this event is a directory\n");
if ($mask & IN_ONLYDIR) fputs($fId, "- Only watch pathname if it is a directory (Since Linux 2.6.15)\n");
if ($mask & IN_DONT_FOLLOW) fputs($fId, "- Do not dereference pathname if it is a symlink (Since Linux 2.6.15)\n");
if ($mask & IN_MASK_ADD) fputs($fId, "- Add events to watch mask for this pathname if it already exists (instead of replacing mask).\n");
if ($mask & IN_ONESHOT) fputs($fId, "- Monitor pathname for one event, then remove from watch list\n");
fclose($fId);
}
}
function getLocation(&$ret, $dir, $depth = 1) {
$d=opendir($dir);
while (($f = readdir($d)) !== false) {
$path = $dir."/".$f;
//echo $path."\n";
if ($f != ".." && $f != "." && is_dir($path) && array_search($f, $ret) === false && $f != "email") {
if (!preg_match("/^[a-z0-9-\.]+\.[a-z]{2,5}$/i", $f)) {
if ($depth <= 3) {
getLocation($ret, $path, $depth+1);
}
} else {
//echo $path." {$f}\n";
if ($depth > 1) $ret[$f] = $path;
}
}
}
}
function addWatchs(&$obj, $path, $skip = array("daemon")) {
global $count,$wd2path;
$tmp = inotify_add_watch($obj, $path,
IN_MODIFY | IN_MOVED_FROM | IN_MOVED_TO | IN_CREATE | IN_DELETE | IN_DELETE_SELF | IN_MOVE_SELF);
//echo " {$path} (ok)\n";
$wd2path[$tmp] = $path;
$count++;
if (is_dir($path)) {
$d = opendir($path);
while (($f = readdir($d)) !== false) {
$lpath = $path."/".$f;
if ($f != ".." && $f != "." && is_dir($lpath) && array_search($f, $skip) === false) {
addWatchs($obj, $lpath, $skip);
continue;
}
/* if (!is_dir($lpath)) {
if (preg_match("/.htaccess|.php|.inc|.phtml$/i", $f)) {
$tmp=inotify_add_watch($obj, $lpath,
IN_MODIFY | IN_MOVED_FROM | IN_MOVED_TO | IN_CREATE | IN_DELETE | IN_DELETE_SELF | IN_MOVE_SELF);
// echo " {$lpath} (ok)\n";
$wd2path[$tmp] = $lpath;
$count++;
}
}*/
}
}
}
?>serv001:~#
