1

Is it possible to monitor all write access to the filesystem of all process under linux?

I've some different mounted filesystems. A lot of them are tempfs.

I'm interested in all writes to the root filesystem except the tempfs, devtmpfs etc.

I'm looking for something that will output: <PID xy> write n Bytes to /targe/filepath .... What monitoring tool can list all this write syscalls? Can they be filtered by mount points?

Improve this question
6
  • you most likely won't be able to do this. To monitor IO to fs, you can use inotify but it will not indicate the amount of read write byte nor the PID, only the file that has been read/write. You can use lsof to list open file by any process with it's process ID but it's instantanious not monitored so you could miss some short file IO. finally you can attach strace to a program, but it's CPU intensive and I'm not sure a system coulc attached strace to all the process. strace is the most complete solution but it is the more complexe as well and probably can't be use system wide.
    – Kiwy
    Jun 20, 2018 at 11:56
  • inotify would be nice, but limit reached by inotifywait -mr /
    – powerpete
    Jun 20, 2018 at 12:02
  • @Kiwy why limit yourself to user-space tools? ;-)
    – Stephen Kitt
    Jun 20, 2018 at 12:08
  • @StephenKitt I already told you I'm a POWER user I tend to stay in the userspace :D
    – Kiwy
    Jun 20, 2018 at 12:13
  • What monitoring tool can list all this write syscalls? Auditing.
    – Andrew Henle
    Jun 20, 2018 at 14:52

1 Answer 1

Reset to default
3

There are a number of tools you can use in various scenarios depending on the exact information you’re looking for. Brendan Gregg has a nice summary:

Diagram of observability tools

For I/O to specific devices, blktrace might be appropriate, although it can be difficult to map its output to specific files.

A better tool for your case could be SystemTap; it’s definitely worth taking the time to learn how to use it. You’d have to trace all file opens and writes, and then post-process the output. That will still miss I/O from memory-mapped files; you’d be able to see that with blktrace but that would be post-pagecache so it wouldn’t catch every explicit write (there’s a discussion of that somewhere on this site but I can’t find it just now). See this answer for an example involving SystemTap (to trace opened files).

Improve this answer
2

Not the answer you're looking for? Browse other questions tagged or ask your own question.