Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I want to find out what files an application has created or modified.

In the old days it was easy. cc foo.c created a.out, cc -o foo foo.c created foo, cc -c foo.x created foo.o. Now applications create files in /var, in /tmp, in some dotted directory in your home folder...

At last count I have more then 1.6 million files on my computer, so I can't just go searching for the files.

So is there a way to find out. Assuming you want to know before running an application.

PS

It looks like writing a ( hopefully ) small program using ptrace to trap the calls to write comes close. I would have to figure out the filename given the handle, which I can do. But before I can do that I must figure out a way whether a handle is associated with "a real file" or a system artifact such as a socket.

share|improve this question
4  
Look at checkinstall, strace or auditd –  Stéphane Chazelas Mar 6 at 15:35
    
@Stephanie, thanks. Don't you need to escalate privileges to use auditd. checkinstall doesn't do what I asked, but for it to work it would need to do that so I might be able to pull something out of it. –  Mouse.The.Lucky.Dog Mar 6 at 17:42

2 Answers 2

You can run strace on an application to track every syscall. For example strace -e open myApplication will record every call to open() and thus all files created by that application, because open() is also used for creating new files. This might miss some special cases where files get moved.

share|improve this answer
1  
Tracing open is not enough. You have to trace what file is open at a certain descriptor at a moment a in time a write takes place. Then you have to associate the write to the file descriptor. Add to that filtering out calls to sockets, fifos, memory-maps and you have one comnplicated program. –  Mouse.The.Lucky.Dog Mar 6 at 17:15

Your package management system should tell you if some file is "owned" by a package (and which). Manuals for commands tell you which files they use, and should tell what temporary files they use (should go in /var/tmp, but often /tmp is used). Your distribution should have some kind of overview of the filesystem, telling you what should go where.

As a regular user you aren't in a position to create files outside of your home directory (except for a very few exceptions, like /var/tmp and /tmp), and programs that a regular user can run that will create files outside the home are very far in between (some games recording higest scores are the only example that comes to mind). This is on purpose and carefully enforced, Unix (and by inheritance Linux) were conceived as multiuser systems (and are regularly used as such), can't allow regular users stomping over each other's (or the system's) files.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.