If I am looking at a process from outside the process how can I tell which files it modifies?

One thing I can do is track calls to write, but a process can map a file to memory and write to the memory modifying the file.

The kernel needs to keep track for two reasons. It needs to know what to flush when a sync is called, and it needs to update the mtime on the file.

So how does the system know?

Also are there any other ways to modify files other then write and mmap?

  • You should probably look into fatrace for tracing a particular process's filesystem access. – Bratchley Apr 18 '14 at 19:06
  • Also, typically, the kernel flushes any pages marked as "dirty" (i.e have been modified) to disk via the pdflush kernel thread. I don't think the file being mapped to memory would have any effect on that process. – Bratchley Apr 18 '14 at 19:09
  • I think fanotify would be a better tool, but am having trouble finding documentation for it. – Mouse.The.Lucky.Dog Apr 19 '14 at 2:47
  • fanotify isn't a tool, it's a service the Linux kernel provides (similar to inotify). It's also the service fatrace is built around. – Bratchley Apr 19 '14 at 3:09

The kernel knows which pages are modified the same way it does any other page: when its written to, a flag in the page tables is set to mark it "dirty". That's done either by the CPU or MMU, or with their help (e.g., they may set the bit directly, or raise an interrupt to have software do it).

But actually, the behavior you're assuming isn't guaranteed. Changed pages needn't be written back (or even queued to be written back) until either msync or munmap is called.

I'm not sure how many other ways there are to modify a file, but there are at least a few:

  1. truncate/ftruncate
  2. writev, pwritev, aio_write (variants of write)
  3. Use it as a swap file, backing device for a loopback device (e.g., /dev/loop0), etc.
  4. There might be ioctl calls that'd change the file contents. Worse, these can be filesystem-specific.
  • A basic question. Is there anyway the system will modify a file ( without deleting it ) without opening the file first? – Mouse.The.Lucky.Dog Apr 19 '14 at 3:23
  • @Mouse.The.Lucky.Dog Well, depends on what you mean by modify a file. Either truncate or link/rename would seem to qualify. (Remember also that truncate doesn't just set the file size to 0—it lets you pick any length. Even growing the file.) – derobert Apr 19 '14 at 3:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.