An Embedded Sensor For Monitoring File Integrity

This paper describes a method of monitoring le integrity (changes in le contents) using a collection of embedded sensors within the kernel. An embedded sensor is a small piece of code designed to monitor a speci c condition and report to a central logging facility. In our case, we have built several such sensors into the 4.4 BSD kernel (OpenBSD V2.7) to monitor for changes in le contents. The sensors look for les which are marked with a speci c system ag in the inode. When the sensors detect a le with this ag, they will report all changes to le contents made through the le system interface. This provides administrators with a valuable audit tool and supplies more reporting granularity than conventional le system integrity checkers (such as Tripwire r ).