Tracing file size changes

[Chris]

On Thu, Aug 11, 2011 at 10:47:00AM +0800, Adam Lee wrote:
> > 
> > Without knowing other ways to find information, I was thinking it would be
> > really nice to have a way to see which files or directories grew or shrank
> > since some point in the past.  Would it be possible to get the kernel to tell
> > me when files were opened for writing and closed so I could record the size
> > difference? > 
> Will Inotify help?
> 
> http://en.wikipedia.org/wiki/Inotify
> http://www.kernel.org/doc/man-pages/online/pages/man7/inotify.7.html
> 

It is pretty much what I want to do, the problem with it is that it doesn't
appear to be recursive.  I'd like to just put a watch on root, and get events
for the entire filesystem, not just that directory.  From playing with this for
a couple minutes, it looks like I'd have to walk the entire filesystem setting
watches on every directory.  So while it is very cool for what it does, I don't
think it will help me out much.

Is doing something with ld_preload to get in the way of every open call the
only way to do this?