4

I have a program which spawns several child processes.

I want to know which files this program and its children are creating, deleting, and modifying.

  • inotifywait can tell me which files are being accessed, but cannot tell me which process is doing it. And I have to know where the files are being created in order to set up the monitor.

  • auditctl will let me log which processes modify a file, but, again, I have to know where the files are in order to set up logging.

  • lsof will tell me all of the files, but doesn't seem to be a good solution for real-time tracking.

Is there anything that will let me monitor a program's file manipulation without knowing a priori which files will be manipulated?

2
  • which filesystem(s) the program would be writing to?
    – VenkatC
    Nov 2, 2015 at 20:18
  • @venkatc: Either ramfs or ext4.
    – Richard
    Nov 3, 2015 at 1:03

2 Answers 2

Reset to default
6

On Linux you can use strace to monitor these kind of events:

strace -f -p <PID> -e trace=file

On Solaris, you can use dtrace. Have a look at the DTraceToolkit tool opensnoop, which is installed by default on Solaris 11 under /usr/dtrace/DTT/Bin/opensnoop.

/usr/dtrace/DTT/Bin/opensnoop -p <pid>
1
  • 1
    It's certainly not the easiest thing to use, akin to drinking from the fire hose, but properly used, you can get a real sense of what's going on underneath the hood.
    – Naftuli Kay
    Nov 2, 2015 at 21:38
5

For Linux: opensnoop from Brendengreg's perf-tools should do the job https://github.com/brendangregg/perf-tools

For Solaris Dtrace is there anyways

1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .