WatchFS

A real-time remotely monitored file system

Comment 1

WatchFS

A Real-time Remotely Monitored File System.

WatchFS is a file system developed in FUSE (Filesystem in User Space). It records the activity happening on the File System in real-time and sends the metadata to a remote server via REST. The server collects the metadata displays statistics and notifications to the user via a dashboard.

Detailed description

WatchFS File System is mounted at any given path (mount point) on the user's machine. It then starts intercepting all the filesystem calls to this mount point. Metadata information from these filesystem calls (creating, deleting, writing a file, etc.) is updated to a remote server via REST API. The filesystem call is then transparently sent to the underlying filesystem. The remote server stores the aggregated information in a database. It provides a dashboard to the user where they can see the statistics, charts, and alert-notifications about their filesystem.

In a nutshell, WatchFS is a layer between userspace and underlying filesystem which captures the metadata from filesystem calls and sends it to a remote server silently for surveillance purposes.

Features

  • Completely transparent to the end user.
  • Real-time remotely monitored.
  • Multi-threaded and fault-tolerant FUSE client, so the REST API calls don't slow down/block the file system calls.
  • Real-time issuing of alert when malicious activity or malicious file is detected.
  • Graphs and tables to display filesystem statistics.
  • Coded in Python ( Yay! ). And also had to use html/js/css for front end ( :( )

Built With

Share this project:

Updates