How to access temporary file straight after creation?

Question

I've script which is connecting to remote host via SSH, creates temporary file and executing the following command:

Calling system(mysql --database=information_schema --host=localhost < /tmp/drush_1JAjtt)

Each time it's creating different file (pattern: drush_xxxxxx).

I've tried couple of times manually running on the remote:

tail -f /tmp/drush_*

but my connection is too slow and most of the time I've end up with the error:

tail: cannot open `/tmp/drush_*' for reading: No such file or directory

Is there any trick accessing such file straight after it's being created to show it's content?

Answer 1

I've ran into this problem when examining behavior of a particular application I didn't trust. The application would create and later delete its temp files. kenorb's solution is good, however using cat can lead to race condition( that is a file may be removed while cat is working, so partial data only is retrieved).

A lower chance of race condition can be done with creating a hard-link to the file itself. greping and creating hard link can be combined via awk. Thus what I've came up with is the following;

inotifywait -e create -m --format "%w/%f" /tmp/suspicious_dir/ 2>&1 | 
awk 'NR>2{n=split($0,a,"/");system("ln "$0" /tmp/hardlink_to_"a[n]);}'

Since we're using -e create flag , we're only interested in temporary files that are going to be immediately created, and the output format gives us the full path to created temp file. Ignoring first two lines of output via NR>2. For every reported file, there will be created a hard link in form /tmp/hardlink_to_<original filename>

Answer 2

You could set up a script that uses inotify (inotify-tools on Debian) and have it scan any changes of files in a particular directory. Then filter out the filename and cat it to a log file.

Answer 3

drush is likely using that temp file in one of two ways:

1. It's creating the file; using it; and then leaving it around.
2. It's creating the file; using it; and then cleaning it up.

My guess is that you wouldn't be asking the question in case (1) because you could just inspect the file manually after the fact. So then the problem is that you want to inspect that temporary file during its momentary lifespan.

Using an external process to monitor for temp files may have a good probability of working -- though it depends on how long the temp files endure (5ms? 500ms? 5s? 5min?) and how quick your monitoring system responds.

Another approach is to instrument the "mysql" command to log the data you're interested in. For example, if "mysql" is in "/usr/bin/mysql", then you might create a file "/usr/local/bin/mysql" with:

#!/bin/bash
LOG=/tmp/mysql-commands
REALCMD=/usr/bin/mysql

NOW=$(date)
echo "[[$NOW: Running: $REALCMD $@]]" >> "$LOG"
tee -a "$LOG" | "$REALCMD" "$@"
exit $?

Answer 4

If the file is created for enough short amount of time, you can run the following command on separate terminal before running the script:

while true; do cat /tmp/drush_* 2>/dev/null && break; done

Where /tmp/drush_* is your pattern. The advantage is that it's quick and you don't have to install any external tools (if you don't have e.g. admin/root permissions).

Please note that using inotifywatch (from inotify-tools) tool won't work in this particular case, because the file is created after the watches have been placed and the change will not be detected. Read more: Why inotify doesn't print list of changed files?

But still you can use inotifywait tool which efficiently waits for changes to files using Linux's inotify interface.

Here is the simple example:

inotifywait -m --format "%e %f" /tmp

And example to show the content of newly created files in /tmp:

inotifywait -m --format "%f" /tmp | grep --line-buffered ^drush | xargs -L1 -I% cat /tmp/% 2> /dev/null

Add sudo before cat if necessary. Change /tmp and drush to your suitable values.