I have a program which spawns several child processes.
I want to know which files this program and its children are creating, deleting, and modifying.
inotifywaitcan tell me which files are being accessed, but cannot tell me which process is doing it. And I have to know where the files are being created in order to set up the monitor.
auditctlwill let me log which processes modify a file, but, again, I have to know where the files are in order to set up logging.
lsofwill tell me all of the files, but doesn't seem to be a good solution for real-time tracking.
Is there anything that will let me monitor a program's file manipulation without knowing a priori which files will be manipulated?