Are there any user-level wrapper-like scripts/programs that can watch what files an application accesses, without impacting performance? I'm trying to capture what files are produced by an automated workflow (i.e. create/modify), so that I can post-process files it produces (and only the files it produced).

I tried literally just mapping out files pre and post run, but that won't work because the files are on a shared NFS mount, so when another host/process writes to the same area (which they need to) it'll confuse the post-processing.

I also tried inotify which had some success (since when used on NFS mounts it doesn't detect files which other hosts have wrote), but unfortunately to monitor an entire directory tree we need to be able to see directories being created to setup additional watches.

So I'm left wondering if there are any programs that can literally capture/log the filesystem calls an application makes, similar to how tsocks (1) works for network calls.

  • to monitor an entire directory tree we need to be able to see directories being created to setup additional watches - the tool inotifywait has --recursive flag – basin Nov 30 '15 at 14:25
  • @Lambert strace kills performance – basin Nov 30 '15 at 14:28
  • @basin I believe that is the same issue - the recursive option sets up additional watches when new directories are created, but if you don't see the directory being created (another host created the directory) then you can't watch it. – AndyC Nov 30 '15 at 14:36
  • So your app acesses files in directories created by other hosts? – basin Nov 30 '15 at 14:39

Moderm kernels have the successor of inotify : fanotify. And there's this experimental tool (requires root):



  • output filterable by PID
  • no need to setup recursive watches.

Good article: http://www.lanedo.com/filesystem-monitoring-linux-kernel/

  • Unfortunately requires root, otherwise looks promising. – AndyC Dec 1 '15 at 0:39

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.