Are there any user-level wrapper-like scripts/programs that can watch what files an application accesses, without impacting performance? I'm trying to capture what files are produced by an automated workflow (i.e. create/modify), so that I can post-process files it produces (and only the files it produced).
I tried literally just mapping out files pre and post run, but that won't work because the files are on a shared NFS mount, so when another host/process writes to the same area (which they need to) it'll confuse the post-processing.
I also tried
inotify which had some success (since when used on NFS mounts it doesn't detect files which other hosts have wrote), but unfortunately to monitor an entire directory tree we need to be able to see directories being created to setup additional watches.
So I'm left wondering if there are any programs that can literally capture/log the filesystem calls an application makes, similar to how tsocks (1) works for network calls.