Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I need to watch a program which modifies some files. I don't know which files the process is modifying_. So I'm looking for a tool that basically outputs a PID, and lista the files being accessed/modified, and what's being done to them (both read and write).

The closest thing I've found so far is iotop, which is definitely on the right track.

iotop -o -b -qqq

That gets me the process and the read/write, but it doesn't indicate the file being accessed. Alternately, I think I could try something like

inotifywatch -r /

but that just runs out of allowed inotify watches.

What is the magic tool I'm looking for?

share|improve this question

2 Answers 2

up vote 2 down vote accepted

You already have your answer, but I asked a similar question before, and we came to the conclusion that fatrace is the ideal solution. It should produce much easier-to-read output than a full strace.

Documentation is on the man page. Basically, you should be able to use the -p option to restrict your view to a particular process.

share|improve this answer
    
Amazing. fatrace is literally exactly what I needed, plus it saved me from writing an ugly, janky shell script with strace and grep. Thanks a lot! –  Tony Mar 7 at 21:14

You could go all the way and use strace on the program. Yes, it tracks ALL system calls (which includes file io & access and other stuff), so you will get quite a messy printout, but it is immediate and doesn't skip anything (it intercepts calls and reports them). You can do the same with library calls (ltrace).

share|improve this answer
    
Yup. It's ugly as hell, but the information I needed was there. Thanks! –  Tony Mar 7 at 19:45

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.