Method for reducing the time to diagnose the cause of unexpected changes to system files

A multi-processor machine for monitoring file access, the machine comprising:

• a file system operable for monitoring accesses to a file residing within the file system;
• an access control mechanism configured to perform:
• inserting an audit entry to an access control list associated with the file, said entry directing the file system to record a loci entry whenever a specific access is requested on said file;
• intercepting the requests;
• verifying that a requesting application has permission to modify the file;
• analyzing an access control list associated with the file;
• and
• executing pre-defined actions when an unauthorized file access occurs;
• a tool to specify a list of the files to be monitored;
• and
• a storage device comprising instructions for invoking writing a log record whenever an audit entry is present in the access control list relating to the file monitored, said instructions comprising:
• identifying information about an application requesting access to the file, including a sequence of function calls that preceded the file access request by:
• walking through a chain of stack frames of a thread of the requesting application, starting from a current stack frame;
• writing a stack trace, name of command requesting the access, user name, group id, and time stamp to the log record to accurately identify the requesting application;
• noting a return address for each stack frame, wherein said return address indicates a caller of each function in a call chain;
• and
• identifying the functions in the call chain based on the return address;
• and
• logging the information to generate an audit trail of the application.

A computer program product embodied on a non-transitory computer readable medium and comprising code that, when executed, causes a computer to perform the following:

• inserting an audit entry to an access control list associated with a file, said entry directing a file system to record a loci entry whenever a specific access is requested on said file;
• monitor a plurality of requests for access to files;
• intercept the requests;
• verify that a requesting application has permission to modify the file;
• analyze an access control list associated with the file;
• when the access control list comprises the audit entry for invoking writing of a log record whenever said audit entry is present in said access control list relating to the file monitored:
• identify information about the application requesting access to the file, including a sequence of function calls that preceded the file access request by:
• walking through a chain of stack frames of a thread of the requesting application, starting from a current stack frame;
• writing a stack trace, and other related information of the application accessing the file to the loci entry, to accurately identify the requesting application;
• noting a return address for each stack frame, wherein said return address indicates a caller of each function in a call chain;
• and
• identifying the functions in the call chain based on the return address;
• log the information to generate an action trail of the application;
• and
• grant or deny access to the file depending on the verifying step.