I have a configuration file and want to learn what executables are using it (if any). I want to catch who is the reader of this file.

If I watch with some interval, I miss it, because the read happens so quickly:

watch -d -n 1 "lsof /home/me/my.conf"

If I try to execute the program I'm pretty sure uses it under the auspices of strace, it fails because of the additional delay strace introduces.

strace -o /tmp/$(date +%s)_myprog.trace myprog

How can I reliably prove that myprog is NOT reading this file?

  • This sounds like a variation of the halting problem. – Kusalananda Jun 10 '17 at 17:46
  • @Kusalananda, in this case, I only need to search for the first 10 or so seconds after starting myprog. – tarabyte Jun 10 '17 at 17:51
  • This might help: stackoverflow.com/questions/9614184/… – Joe P Jun 10 '17 at 18:25
  • This question does not seem a duplicate of that particular question. This question is about realtime debugging, the old question mentions finding out if a file was accessed in the last few days. While some answers will overlap, there will be different strategies and answers. – Rui F Ribeiro Jun 11 '17 at 9:27

Watching what files a process open, or what processes open a file seems a job for sysdig.

From the sysdig examples page

Basic opensnoop: snoop file opens as they occur

sysdig -p "%12user.name %6proc.pid %12proc.name %3fd.num %fd.typechar %fd.name" evt.type=open

Observe the I/O activity on all files named my.conf

sysdig -A -c echo_fds "fd.filename=my.conf"

Fom man sysdig

NAME sysdig - the definitive system and process troubleshooting tool

SYNOPSIS sysdig [option]... [filter]


   sysdig is a tool for  system  troubleshooting,  analysis  and  explo‐
   ration.   It  can  be used to capture, filter and decode system calls
   and other OS events.
   sysdig can be both used to inspect live systems, or to generate trace
   files that can be analyzed at a later stage.

   sysdig  includes  a powerul filtering language, has customizable out‐
   put, and can be extended through Lua scripts, called chisels.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.