GitHub - ANGulchenko/whatmade: Whatmade is a Linux daemon that monitors user-specified directories and records which process created each file.
github.com
Whatmade is a Linux daemon that monitors user-specified directories and records which process created each file. - ANGulchenko/whatmade

Story behind the daemon: a few weeks ago I noticed that I don’t have space in my /home. Investigation led to deleting ~20GiB of ancient garbage from the dot-dirs there. In too many cases I wasn’t been able to detect who created those files and if I need them. I didn’t like this situation, so I present you with a solution.

Be careful, though: the code isn’t tested. It is more like working “proof-of-concept” than a real release. Code is ugly as hell too. Pre-release beta of the alpha version.

But it works on my machine and can be initialized through the CLI, without recompiling or manual DB-editing. So it is usable. So use it.

  • SayCyberOnceMore@feddit.ukEnglish
    5·
    14 days ago

    Hmm, interesting…

    As you’re here (easier than raising a ticket on github 😉)…

    At present, the daemon doesn’t strictly detect file creation events. Instead, it logs processes that access files

    2 things come to mind…

    1. Just curiosity - why not the creation time?
    2. If I set noatime in my fstab, does that nullify this?
    • Lembot_0004@discuss.onlineOPEnglish
      4·
      14 days ago

      I do analyze creation time to differentiate creating from just accessing the old file. Yes, tampering with time will mess a little but it won’t be critical for the daemon functionality.