Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I don't know if I'm looking for a file integrity monitoring software here.

Basically let's say we have firefox or chromium, let's say the user is watching a youtube video, then we'll find that video in our cache right? Now i would like to know if a specific application is creating or modifying some file, even if it calls an "external module" (like, I don't know, launching mkdir command on linux from our target application).

I need a software that does that online, when it's happening. I have just to tell him which process has to be monitored.

I need it for Windows right now but since the application is multi-platform a Linux solution would be ok.

share|improve this question

2 Answers 2

up vote 7 down vote accepted

If you're looking for something interactive, and not service-style long-term monitoring software, check out Microsoft's (nee SysInternal) Process Monitor.
Very versatile.

share|improve this answer
    
+1 for ProcMon. –  Steve Mar 9 '11 at 19:07
    
that's perfect. thanks! –  dierre Mar 9 '11 at 19:21

On the Linux side you can do this kind of monitoring using the auditd subsystem and very cleverly written rules. It can be used to watch for changes to files or directories, entry or exits of system calls, etc.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.