A file system that will tell you who accessed what files or
directories, and when. The file system will record, via direct
console messages or syslog [SMCC90], the uid and gid of a
process accessing files in this file system, the names of the
files or directories, and the time of access. After recording
this information, Snoopfs will forward the vnode request to the
interposed file system, thus hiding the fact that this file
system is being monitored. Unix file permissions provide a
mechanism to protect one's files from prying eyes, but there are
many ways for remote users, especially ones with local root
access on their workstations, to become a different user (using
the su program) and then try and access someone else's files.
Besides, even if the user was unsuccessful at poking about
someone else's files (maybe a student looking for a leftover
copy of a final exam in their instructor's account), the fact
that such access was attempted may be an interesting fact on its
own.