I want to find out what files an application has created or modified.
In the old days it was easy.
cc foo.c created
cc -o foo foo.c created foo,
cc -c foo.x created
foo.o. Now applications create files in
/tmp, in some dotted directory in your home folder...
At last count I have more then 1.6 million files on my computer, so I can't just go searching for the files.
So is there a way to find out. Assuming you want to know before running an application.
It looks like writing a ( hopefully ) small program using ptrace to trap the calls to write comes close. I would have to figure out the filename given the handle, which I can do. But before I can do that I must figure out a way whether a handle is associated with "a real file" or a system artifact such as a socket.