---
name: "logwrites"
section: "3"
platform: "linux"
package: "logwrites"
version: "1.1-3"
release: "Debian 1.2 (Rex)"
platforms: ["linux"]
url: "https://new.carta.tech/logwrites/3"
---

# logwrites(3)

Library for intercepting and recording writes to files, and optionally saving backups of files that otherwise would have been overwritten.

## NAME

logwrites - Library for intercepting and recording writes to files,\
 		and optionally saving backups of files that otherwise\
 		would have been overwritten.

## SYNOPSIS

Bash, Ksh and Bourne shell syntax:

INSTALL\_LOG=log\_file LD\_PRELOAD=/usr/lib/logwrites.so command SAVE\_ DO\_BACKUPS=1 INSTALL\_LOG=log\_file LD\_PRELOAD=/usr/lib/logwrites.so command

C Shell syntax:

env INSTALL\_LOG=log\_file LD\_PRELOAD=/usr/lib/logwrites.so shell\_command env DO\_BACKUPS=1 INSTALL\_LOG=log\_file LD\_PRELOAD=/usr/lib/logwrites.so shell\_command

## DESCRIPTION

**logwrites** is a library that intercepts the [open(2)](/open/2.md), [link(2)](/link/2.md), [rename(2)](/rename/2.md), [symlink(2)](/symlink/2.md), [unlink(2)](/unlink/2.md), [mkdir(2)](/mkdir/2.md), [mknod(2)](/mknod/2.md), and [truncate(2)](/truncate/2.md) system calls and records these events in a file after successful execution of the system call.  It can also optionally save a backup copy of any file that would otherwise have been overwritten by [open(2)](/open/2.md).

### ARGUMENTS

Arguments to **logwrites** are passed through the following environmental variables.

- *LOG\_FILE*

  The name of the file in which to record the file modification events.

- *DO\_BACKUPS*

  If this environmental variable is defined (regardless of its value), then save a backup of any file that would otherwise have been overwritten or deleted by [open(2)](/open/2.md), [rename(2)](/rename/2.md) or [unlink(2)](/unlink/2.md).

## BUGS

Logwrites does not currently intercept the system calls that merely change a file's inode information.  It also does not do log, make backups, or do any other special processing for open() system calls that do not truncate the file on opening, or for [truncate(2)](/truncate/2.md) calls that truncate the file length to something other than zero.  It is unclear exactly what to do in these cases because this may be the case of a few bytes being modified in a large database, and making backup files every time this happens may not be a good idea.

**Logwrites** uses the ELF shared library mechanism to intercept system calls.  As a result, it cannot trace the actions of statically linked executables, non-ELF executables, setuid executables, or executables that make system calls directly with the system call trap or through the syscall() routine.

There is hope for one other problem, though.  There is currently no way of stacking "filter libraries" like logwrites.  You can only have one such library preloaded.  For example, you cannot use logwrites in conjunction with zlibc (a library that implements transparent decompression by intercepting the [open(2)](/open/2.md) system call).  The solution to this problem is to add a new symbol type to ELF that \*only\* for external references that were unresolved when the library was loaded, similar to the "weak" attribute in ELF.  This would allow logwrites to use different names internally to refer the routines that implement [open(2)](/open/2.md), [symlink(2)](/symlink/2.md), etc., and then make calls references to routines named open(), symlink(), etc., that are resolved by the regular C library or the next "filter library."

## AUTHOR

Adam J. Richter (adam@yggdrasil.com)

## COPYRIGHT

Copyright 1996 Yggdrasil Computing, Inc.

logwrites and its documentation may be freely copied under the terms and conditions of version 2 of the GNU General Public License, as published by the Free Software Foundation (Cambridge, Massachusetts, United States of America).