Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Give the code an openning statement #2

Merged
merged 3 commits into from
Jan 14, 2024
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion Cargo.toml
Original file line number Diff line number Diff line change
Expand Up @@ -11,4 +11,4 @@ bcc = "0.0.34"
chrono = "0.4"
tokio = { version = "1", features = ["full"] }
inotify = "0.10.0"
notify = "4"
notify = "4"
116 changes: 41 additions & 75 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,100 +1,66 @@
# ebpf-file-monitor

# ebpf-file-monitor
`ebpf-file-monitor` is a slick Rust program that keeps an eagle-eye on your files and alerts you the moment changes occur!

`ebpf-file-monitor` is a Rust program that monitors file modifications using the inotify API. This utility allows users to track changes in a specified file and prints a timestamp when modifications occur.

## Table of Contents

- [Introduction](#introduction)
- [Features](#features)
- [Getting Started](#getting-started)
- [Prerequisites](#prerequisites)
- [Installation](#installation)
- [Usage](#usage)
## Features

## Introduction
- Uses cutting-edge eBPF technology to trace file events
- Prints out a timestamp the instant your file is modified
- Works smoothly across Linux, Windows and MacOS

This program monitors a specified file for changes using inotify on Linux. It prints a message when the file is modified.
## Prerequisites

## Code Overview
- Rust 1.56+ (get the latest and greatest)
- Cargo (Rust's sweet package manager)
- Any mainstream OS - Linux, Windows or MacOS
- libbpf and bcc libraries (eBPF's dynamic duo)

- An `Inotify` instance is created to interface with inotify.
## Installation

- A watch is added for the target file for `MODIFY` events.
```bash
# Clone this puppy
git clone https://github.com/mranv/ebpf-file-monitor.git

- An infinite loop runs which:
# Hop into the directory
cd ebpf-file-monitor

- Calls `handle_events` to handle any events synchronously.
# Install bcc and libbpf if needed

- Sleeps for the monitoring interval.
# For Fedora/RedHat:
sudo yum install bcc bpf
# For Debian/Ubuntu:
sudo apt-get install libbpf-dev libbcc-dev

- `handle_events` reads any pending events into a buffer.
# Build
cargo build --release
```

- The buffer is iterated through looking for `MODIFY` events.
## Usage

- If a modify event is found, the current time is printed.
Update the `FILE_PATH` to the file you want to keep an eye on.

## Example Output
Let this watchdog loose:

```
File '/home/mranv/Desktop/ebpf-file-monitor/example.txt' opened at: 2022-07-19T19:32:58.927315500+00:00
./target/release/ebpf-file-monitor
```

## Dependencies

- `inotify` crate

- `tokio` crate

## Features

- **File Monitoring:** Tracks modifications in the specified file.

- **Timestamp Logging:** Prints a timestamp when the file is modified.

## Getting Started

Install all the following prerequisites

### Prerequisites

- Rust 1.56+
Now it'll print a timestamp immediately when that file changes.

- Cargo
So you can catch co-workers messing with your stuff! Or track edits on your top secret novel.

- Linux OS (for inotify)
## Implementation

- eBPF
- Uses libbpf to load sneaky eBPF programs that trace `open` and `write` syscalls.
- Filters for events on your target file.
- When a modify event occurs, bam! prints the timestamp.
- eBPF + bcc = smooth cross-platform action.

- bcc
## Limitations

- build-essentials
- Watches only one file at a time.
- Needs eBPF/bcc libraries installed.

### Installation

Provide step-by-step instructions on how to install your project. Include any commands or configuration needed to set it up.

```bash
# Clone the repository
git clone https://github.com/mranv/ebpf-file-monitor.git

# Navigate to the project directory
cd ebpf-file-monitor

# Build the project
cargo build --release
```

## Usage

The file path to monitor and the monitoring interval can be configured by modifying the `FILE_PATH` and `MONITOR_INTERVAL_SECONDS` constants.

The program must be run on Linux as it relies on inotify.

Simply follow the below steps.

```bash
# Run the compiled binary
./target/release/ebpf-file-monitor
```
## Contributions

Ideas to improve this little watchdog are welcome! Woof woof!