Re: [zfs-discuss] Intrusion Detection - powered by ZFS Checksumming ?

2010-02-09 Thread Kjetil Torgrim Homme
Neil Perrin writes: > On 02/09/10 08:18, Kjetil Torgrim Homme wrote: >> I think the above is easily misunderstood. I assume the OP means >> append, not rewrites, and in that case (with recordsize=128k): >> >> * after the first write, the file will consist of a single 1 KiB record. >> * after the

Re: [zfs-discuss] Intrusion Detection - powered by ZFS Checksumming ?

2010-02-09 Thread Neil Perrin
On 02/09/10 08:18, Kjetil Torgrim Homme wrote: Richard Elling writes: On Feb 8, 2010, at 9:10 PM, Damon Atkins wrote: I would have thought that if I write 1k then ZFS txg times out in 30secs, then the 1k will be written to disk in a 1k record block, and then if I write 4k then 30secs latte

Re: [zfs-discuss] Intrusion Detection - powered by ZFS Checksumming ?

2010-02-09 Thread Kjetil Torgrim Homme
Richard Elling writes: > On Feb 8, 2010, at 9:10 PM, Damon Atkins wrote: > >> I would have thought that if I write 1k then ZFS txg times out in >> 30secs, then the 1k will be written to disk in a 1k record block, and >> then if I write 4k then 30secs latter txg happen another 4k record >> size bl

Re: [zfs-discuss] Intrusion Detection - powered by ZFS Checksumming ?

2010-02-08 Thread Richard Elling
On Feb 8, 2010, at 9:10 PM, Damon Atkins wrote: > I would have thought that if I write 1k then ZFS txg times out in 30secs, > then the 1k will be written to disk in a 1k record block, and then if I write > 4k then 30secs latter txg happen another 4k record size block will be > written, and then

Re: [zfs-discuss] Intrusion Detection - powered by ZFS Checksumming ?

2010-02-08 Thread Damon Atkins
I would have thought that if I write 1k then ZFS txg times out in 30secs, then the 1k will be written to disk in a 1k record block, and then if I write 4k then 30secs latter txg happen another 4k record size block will be written, and then if I write 130k a 128k and 2k record block will be writt

Re: [zfs-discuss] Intrusion Detection - powered by ZFS Checksumming ?

2010-02-08 Thread Kjetil Torgrim Homme
Damon Atkins writes: > One problem could be block sizes, if a file is re-written and is the > same size it may have different ZFS record sizes within, if it was > written over a long period of time (txg's)(ignoring compression), and > therefore you could not use ZFS checksum to compare two files.

Re: [zfs-discuss] Intrusion Detection - powered by ZFS Checksumming ?

2010-02-08 Thread Damon Atkins
May be look at rsync and rsync lib (http://librsync.sourceforge.net/) code to see if a ZFS API could be design to help rsync/librsync in the future as well as diff. It might be a good idea for POSIX to have a single checksum and a multi-checksum interface. One problem could be block sizes, if

Re: [zfs-discuss] Intrusion Detection - powered by ZFS Checksumming ?

2010-02-08 Thread Daniel Carosone
On Mon, Feb 08, 2010 at 11:24:56AM -0800, Lutz Schumann wrote: > > Only with the zdb(1M) tool but note that the > > checksums are NOT of files > > but of the ZFS blocks. > > Thanks - bocks, right (doh) - thats what I was missing. Damn it would be so > nice :( If you're comparing the current dat

Re: [zfs-discuss] Intrusion Detection - powered by ZFS Checksumming ?

2010-02-08 Thread Lutz Schumann
> Only with the zdb(1M) tool but note that the > checksums are NOT of files > but of the ZFS blocks. Thanks - bocks, right (doh) - thats what I was missing. Damn it would be so nice :( -- This message posted from opensolaris.org ___ zfs-discuss mailin

Re: [zfs-discuss] Intrusion Detection - powered by ZFS Checksumming ?

2010-02-08 Thread Darren J Moffat
On 08/02/2010 12:55, Lutz Schumann wrote: Hello, an idea popped into my mind while talking about security and intrusion detection. Host based ID may use Checksumming for file change tracking. It works like this: Once installed and knowning the software is "OK", a baseline is created. Then in

[zfs-discuss] Intrusion Detection - powered by ZFS Checksumming ?

2010-02-08 Thread Lutz Schumann
Hello, an idea popped into my mind while talking about security and intrusion detection. Host based ID may use Checksumming for file change tracking. It works like this: Once installed and knowning the software is "OK", a baseline is created. Then in every check - verify the current status