1

Is it possible to monitor all write access to the filesystem of all process under linux?

I've some different mounted filesystems. A lot of them are tempfs.

I'm interested in all writes to the root filesystem except the tempfs, devtmpfs etc.

I'm looking for something that will output: <PID xy> write n Bytes to /targe/filepath .... What monitoring tool can list all this write syscalls? Can they be filtered by mount points?

|improve this question

closed as off-topic by Kusalananda♦, Jeff Schaller♦, Thomas Nyman, slm♦ Jun 22 '18 at 0:38

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question has been posted on multiple sites. Cross-posting is strongly discouraged; see the help center and community FAQ for more information." – Kusalananda, Jeff Schaller, Thomas Nyman, slm

  • you most likely won't be able to do this. To monitor IO to fs, you can use inotify but it will not indicate the amount of read write byte nor the PID, only the file that has been read/write. You can use lsof to list open file by any process with it's process ID but it's instantanious not monitored so you could miss some short file IO. finally you can attach strace to a program, but it's CPU intensive and I'm not sure a system coulc attached strace to all the process. strace is the most complete solution but it is the more complexe as well and probably can't be use system wide. – Kiwy Jun 20 '18 at 11:56
  • inotify would be nice, but limit reached by inotifywait -mr / – powerpete Jun 20 '18 at 12:02
  • @Kiwy why limit yourself to user-space tools? ;-) – Stephen Kitt Jun 20 '18 at 12:08
  • @StephenKitt I already told you I'm a POWER user I tend to stay in the userspace :D – Kiwy Jun 20 '18 at 12:13
  • What monitoring tool can list all this write syscalls? Auditing. – Andrew Henle Jun 20 '18 at 14:52
3

There are a number of tools you can use in various scenarios depending on the exact information you’re looking for. Brendan Gregg has a nice summary:

Diagram of observability tools

For I/O to specific devices, blktrace might be appropriate, although it can be difficult to map its output to specific files.

A better tool for your case could be SystemTap; it’s definitely worth taking the time to learn how to use it. You’d have to trace all file opens and writes, and then post-process the output. That will still miss I/O from memory-mapped files; you’d be able to see that with blktrace but that would be post-pagecache so it wouldn’t catch every explicit write (there’s a discussion of that somewhere on this site but I can’t find it just now). See this answer for an example involving SystemTap (to trace opened files).

|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.