On Thu, Aug 11, 2011 at 10:47:00AM +0800, Adam Lee wrote:

quoted

Without knowing other ways to find information, I was thinking it would be
really nice to have a way to see which files or directories grew or shrank
since some point in the past.  Would it be possible to get the kernel to tell
me when files were opened for writing and closed so I could record the size
difference? > 

Will Inotify help?

http://en.wikipedia.org/wiki/Inotify
http://www.kernel.org/doc/man-pages/online/pages/man7/inotify.7.html

It is pretty much what I want to do, the problem with it is that it doesn't
appear to be recursive.  I'd like to just put a watch on root, and get events
for the entire filesystem, not just that directory.  From playing with this for
a couple minutes, it looks like I'd have to walk the entire filesystem setting
watches on every directory.  So while it is very cool for what it does, I don't
think it will help me out much.

Is doing something with ld_preload to get in the way of every open call the
only way to do this?