# How to trigger events within jail on file creation



## jef (Feb 28, 2017)

I'd like to be able to configure the ability to trigger events _within a jail _when files are created in specific directories. While I can use `auditd` and `praudit` to capture file creation on the _host, _as far as I know _jailed _use of that facility isn't possible, even with providing /dev/auditpipe to the jail. (Please let me know if I'm wrong on that.)

https://forums.freebsd.org/threads/53580/ is pretty close to what I'd like to be able to accomplish, _but within a jail._

I _could _run `auditd` on the _host_ and then use `jexec` to trigger action within the jail. This, however, makes the jail not easily portable, as it depends on the configuration of the host. 

Within the jail, I could run a `cron` job to check every minute for the file creation, but that's something of a sledgehammer, as these events don't happen very often.

Any other suggestions on how to configure this kind of in-jail watch/trigger?


----------



## jef (Feb 28, 2017)

I've also looked at sysutils/inotify-tools for this, but unfortunately it isn't possible to capture file _move _events without kernel patches, according to devel/libnotify. Given that limitation, I haven't examined if kqueue(2) is available within a jail or not.


----------

