I’m in the process of setting up a read-only root filesystem on a cluster, so I’m looking for ways to track all attempts to write to disk. Tonight I ran across a nifty little utility by Robert Love called inotify-glib, which looks like it’ll do just the trick. I plan to start it just before chrooting into the NFS root.