If I am looking at a process from outside the process how can I tell which files it modifies?
One thing I can do is track calls to write, but a process can map a file to memory and write to the memory modifying the file.
The kernel needs to keep track for two reasons. It needs to know what to flush when a sync is called, and it needs to update the mtime on the file.
So how does the system know?
Also are there any other ways to modify files other then write and mmap?