Tag Info

New answers tagged


There should be at least one filesystem mounted read-write. Run mount to see all mounted filesystems, and look for one mounted read-write (rw): mount | grep rw. I expect you'll find /var mounted read write, and /var/tmp and/or /tmp should be writeable.


In case of > eg. cat abc.txt > pqr.txt The contents of pqr.txt will be replaced with that of abc.txt In case of >> eg. cat abc.txt >> pqr.txt The contents of abc.txt will be appended with that pqr.txt at the end.


You might want to try systemtap. Here is a slightly modified example showing opens, reads and writes every 100ms: #! /usr/bin/env stap global fileread, filewrite probe syscall.open.return { if ($return != -1) { printf("open, %s, %d/%d\n", user_string($filename), pid(), $return) } } probe syscall.read.return { p = pid() fd = $fd ...


Linux's auditd can get the information for points 1 and 2. Assuming you are running RHEL/CentOS 6 and have an nfs share mounted as /mnt/nfs/foo: $ tree /mnt/nfs/foo /mnt/nfs/foo |-- a | `-- foo |-- b `-- bar You will need to define the following rules in /etc/audit/audit.rules: # Delete existing rules -D # Set buffer size -b 320 # Log read and ...

Top 50 recent answers are included