Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.
Sign up to join this community
Is there a way to list all the files being opened on the system?
Either display all the currently opened files (with their full path, probably some lsof option), or, more interesting in my case, just list the pathnames as they are being opened (in the manner of tail -f), which I don't think lsof is able to do.
The program inotifywait is intended for performant file monitoring such as what you are looking for. Here is a proof of concept:
$ inotifywait -qrm -e open -e access --format "%e %f" tmp/
OPEN hello
OPEN,ISDIR
ACCESS,ISDIR
OPEN hello
The output comes from running touch tmp/hello, followed by less tmp/h<TAB> (which tab-completes to less tmp/hello), followed by Enter to open the file with Less.
When run system wide, you will probably want to exclude places such as /proc and /sys. You might also want to pipe it through grep -vE '^(OPEN|ACCESS),ISDIR$ to exclude directories. Finally, you should also have a look at the caveat given for recursive monitoring:
Warning: If you use this option while watching the root directory of a large tree, it may take quite a while until all inotify watches are established, and events will not be received in this time. Also, since one inotify watch will be established per subdirectory, it is possible that the maximum amount of inotify watches per user will be reached. The default maximum is 8192; it can be increased by writing to /proc/sys/fs/inotify/max_user_watches.
top-lookalike but although this is quite a bit more complex, that'll do.