Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to debug a program which is not logging the information I need. Fortunately, it does write temporary files which should contain the information. These files are written to a directory like: program/temp/{someGUID} on one of ten machines. Neither {someGUID} nor which machine will contain the temp files is known in advance of the run. After the run is complete, the temporary files are deleted. The time from beginning to end is too fast for manual intervention.

I kick off the runs through a client program, but it is the server which writes the files. I am unable to manipulate the server program and once a run is kicked off I am unable to stop it. I do have root access to the all the machines on which the temp files could be written. I'm running CentOS 6.

Is there a way to allow the server user to write files to the temp directory but not remove them? It would probably crash the run, but it would give me the information I need. Is there a way to copy the contents of the temp folder right after they are written/before they are deleted? Must I install a program for recovery of deleted files?

share|improve this question
Could that one help? stackoverflow.com/questions/869536/… – Bonsi Scott Apr 3 '13 at 20:12
Thanks, that looks promising. I'll read up on setfacl – Daniel Koverman Apr 3 '13 at 20:22
Unless I am misunderstanding something, it looks like setfacl will not work because the server user is the owner of the files and ACLs can't restrict the owner. – Daniel Koverman Apr 3 '13 at 20:50
See also List the files accessed by a program (but on second thoughts, this isn't a duplicate, because viewing the file contents wasn't a concern in that thread) – Gilles Apr 4 '13 at 0:46
up vote 1 down vote accepted

List the files accessed by a program mentions several ways to log the program's file accesses (strace, LD_PRELOAD, LoggedFS, audit), but no convenient way to grab the file contents.

A convenient way to save all the program's output is copyfs. CopyFS creates a view of a directory tree that retains all past versions of all files that ever existed in that directory tree. Mount the directory containing the temporary files:

mkdir versions
copyfs-mount $PWD/versions $PWD/program/temp
fusermount -u program/temp
ls versions
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.