My HDD mountpoint was at /mnt/old, now I changed it to /mnt/new

So for seamless transition now /mnt/old is a symlink to /mnt/new.

Gradually I want all the programs to use the new mountpoint. How can I monitor what programs access the old path (currently symlink)?

fanotify doesn't work, it resolves the final path, so monitors /mnt/new.

  • fanotify_mark(2) tells about a flag FAN_MARK_DONT_FOLLOW to not follow symlinks. Maybe the tool you are using could benefit from this?
    – A.B
    Jul 18, 2021 at 10:49
  • seems like it doesn't register any events then (working with /mnt/old, if I specify /mnt/old/ then it's like before)
    – asd
    Jul 18, 2021 at 11:04
  • Does it work if you make /mnt/old a bind mount instead of a symlink to /mnt/new? Or export /mnt/new via nfs and mount it from the same machine on /mnt/old? (I'm not able to test any of those right now)
    – user313992
    Jul 18, 2021 at 14:50

1 Answer 1


You can use one of Brendan Gregg's perf-tools, namely opensnoop, which is an ftrace script to monitor for files of a given name (a regular expression) being opened. For an ls command you would get output something like

$ sudo opensnoop /mnt/old
COMM             PID      FD FILE
ls               9263    0x3 /mnt/old

There are many other remarkable performance analysis tools based on Linux perf and ftrace in the set.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .