Patent ID: 8621605

Claim:
A method for monitoring access to a file within a file system in a computer, the method comprising steps of: inserting an audit entry to an access control list associated with the file, said entry directing the file system to record a log entry whenever a specific access is requested on said file; monitoring a plurality of requests for access to files; intercepting the requests; verifying that a requesting application has permission to modify the file; analyzing a metadata associated with the file; when the metadata comprises the audit entry used to invoke writing a log record, performing steps of: identifying information about the application requesting access to the file, including a sequence of function calls that preceded the file access request by: walking through a chain of stack frames of a thread of the requesting application, starting from a current stack frame; writing a stack trace, and other related information of the application accessing the file to the log entry to accurately identify the requesting application; noting a return address for each stack frame, wherein said return address indicates a caller of each function in a call chain; and identifying the functions in the call chain based on the return address; logging the information to generate an audit trail of the application; and granting or denying access to the file depending on the verifying step.