We're making headway *.  I have PRECALL and POSTCALL hooks in most 
of the vfs functions for Linux 2.4.  Now that those are in, the logeventfs 
can actually log filesystem events.  It's certainly not done, but it's at 
a point where it's starting to show some results.  For example, running 
"ls -al", "touch hi", and "df" on a logeventfs filesystem gives the 
following in syslog:

Apr 17 23:10:30 sparrow kernel: Registering logeventfs version 0.5 $Id: main.c,v 1.33 2003/02/09 17:50:53
cwright Exp $
Apr 17 23:11:21 sparrow logger: ls -al
Apr 17 23:11:25 sparrow kernel: logeventfs: readdir:  file /
Apr 17 23:11:25 sparrow kernel: logeventfs: lookup:   file sa-blacklist.2003040903
Apr 17 23:11:25 sparrow kernel: logeventfs: lookup:   file KERNEL-TODO
Apr 17 23:11:25 sparrow kernel: logeventfs: lookup:   file Makefile.300modules
Apr 17 23:11:25 sparrow kernel: logeventfs: lookup:   file rsync-backup-0.2.1.tar.gz
Apr 17 23:11:25 sparrow kernel: logeventfs: lookup:   file test
Apr 17 23:11:25 sparrow kernel: logeventfs: lookup:   file newfile
Apr 17 23:11:25 sparrow kernel: logeventfs: readlink: file ggg2
Apr 17 23:11:25 sparrow kernel: logeventfs: lookup:   file ggg3
Apr 17 23:11:25 sparrow kernel: logeventfs: lookup:   file ggg5
Apr 17 23:11:25 sparrow kernel: logeventfs: readlink: file ggg5
Apr 17 23:11:25 sparrow kernel: logeventfs: lookup:   file gg8
Apr 17 23:11:25 sparrow kernel: logeventfs: lookup:   file ww
Apr 17 23:11:25 sparrow kernel: logeventfs: readlink: file ww
Apr 17 23:11:25 sparrow kernel: logeventfs: readdir:  file /
Apr 17 23:11:37 sparrow logger: touch hi
Apr 17 23:11:44 sparrow kernel: logeventfs: lookup:   file hi
Apr 17 23:11:44 sparrow kernel: logeventfs: create:   file hi
Apr 17 23:11:44 sparrow kernel: logeventfs: setattr:  file hi
Apr 17 23:11:52 sparrow logger: df
Apr 17 23:11:54 sparrow kernel: logeventfs: statfs:

        I'm uploading all of the files involved to
http://www.stearns.org/fist/ .  If you'd just like to try out the 
filesystem, pull down logeventfs-0.5.tar.gz , open it up, change into that 
directory, and:
make logeventfs.o
sudo insmod ./logeventfs.o
sudo mkdir /mnt/fist
sudo mount -t logeventfs -o dir=/usr/src/bunchoffiles /usr/src/bunchoffiles /mnt/fist
cd /mnt/fist

        then watch syslog as you perform operations on /mnt/fist.

        If you'd like to build it yourself, you'll need to apply
fistgen-getopt-patch and newhooks.2003041701.patch to the fistgen sources, 
do the normal fistgen setup, and:
./fistgen /path/to/logeventfs.fist
cd out/Linux-2.4/logeventfs
make logeventfs.o
sudo insmod ./logeventfs.o
sudo mkdir /mnt/fist
sudo mount -t logeventfs -o dir=/usr/src/bunchoffiles /usr/src/bunchoffiles /mnt/fist
cd /mnt/fist