I need a program which generates events when a file is moved, removed or its extended attributes are changed. I'm running Ubuntu Karmic Koala 32-bit desktop.
inotify is the standard solution for such problems, but inotify cannot install a recursive watch, so the only option is to the equivalent of
find on the filesystem, and add an inotify watch on each node. This is what e.g.
inotifywatch does. This won't work for me, because my filesystem has 1 million files, and installing watches to all of them takes forever.
fanotify could work except that I would have to patch the kernel for that (I'm currently running 2.6.31-20), and maintaining patches to the Linux kernel is beyond my time commitment.
I used to use rfsdelta (whose kernel module is similar to rlocate), but it just doesn't compile on 2.6.31, because it uses obsolete Linux security framework APIs.
I suspect that on-demand antivirus software on Linux might use some other technique I don't know of.