Is there a way to list all the files being opened on the system?

Either display all the currently opened files (with their full path, probably some lsof option), or, more interesting in my case, just list the pathnames as they are being opened (in the manner of tail -f), which I don't think lsof is able to do.


1 Answer 1


The program inotifywait is intended for performant file monitoring such as what you are looking for. Here is a proof of concept:

$ inotifywait -qrm -e open -e access --format "%e %f" tmp/
OPEN hello
OPEN hello

The output comes from running touch tmp/hello, followed by less tmp/h<TAB> (which tab-completes to less tmp/hello), followed by Enter to open the file with Less.

When run system wide, you will probably want to exclude places such as /proc and /sys. You might also want to pipe it through grep -vE '^(OPEN|ACCESS),ISDIR$ to exclude directories. Finally, you should also have a look at the caveat given for recursive monitoring:

Warning: If you use this option while watching the root directory of a large tree, it may take quite a while until all inotify watches are established, and events will not be received in this time. Also, since one inotify watch will be established per subdirectory, it is possible that the maximum amount of inotify watches per user will be reached. The default maximum is 8192; it can be increased by writing to /proc/sys/fs/inotify/max_user_watches.

  • 1
    I was hoping for some top-lookalike but although this is quite a bit more complex, that'll do.
    – dargaud
    Feb 5, 2021 at 20:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.