I want to implement sort of trip-wire security mechanism, that tracks in real time events when user writes a file with a specific content on hard drive of his workstation (which will be managed by me).
Otherwise brilliant loggedfs doesn't let me monitor file's contents, only file names.
What other option do I have? I guess I need something similar to the stuff that real-time antivirus software uses.
P.S. I can use btrfs and rely on its leaf block checksums. But I prefer a more general solution.