0

I would like to list all files that have been read, created or updated from the app running.

1
  • 1
    Do you need this information about a program that is already running, or, instead, is an answer that would help find this information by running a program in a specific way acceptable?
    – dhag
    Dec 28, 2015 at 19:10

3 Answers 3

0

The answer is within Monitor a program's I/O with opensnoop available on many Unix (and not only Solaris).

0

I am not aware of any application or tool that will give you all the information you need about a process in one place. But, if you understand Linux there are a few things that will make it worthwhile. The first is that everything is a file. This is great because you can simply cat files for information. The second is that all information that you need about processes is in /proc. If you have a PID of a parent process then you can find anything you like about the process from there. I would suggest man proc.

0

Get your process ID (firefox for instance, the second grep is to hide the grep search itself):

ps aux | grep firefox | grep -v grep

You will get something like:

<login>  <pid> .... /path/to/program

You can then run file on /proc/pid/fd/*

file /proc/1809/fd/*

You will get something like:

....
/proc/1809/fd/94:  symbolic link to `/home/pp/.mozilla/firefox/79bmloy7.default/formhistory.sqlite' 
/proc/1809/fd/96:  symbolic link to `/home/pp/.mozilla/firefox/79bmloy7.default/signons.sqlite' 
....

Not the answer you're looking for? Browse other questions tagged .