Continuously monitor files opened/accessed by a process

Question

lsof -p 12345 will list all the files opened by process whose pid is 12345 but only for a particular instant of time.

How can we continuously monitor a process from the start to end(until process is terminated) to list/show every single file accessed by the process during its whole lifetime?

[How do I monitor opened files of a process in realtime?](https://unix.stackexchange.com/q/58887/44425) — phuclv, May 22 '17 at 03:36

score 34 · Accepted Answer · edited Mar 20 '17 at 10:17

34

Try with strace -p 12345; it should do what you are trying to achieve.

The output can be filtered to only display opened files (Dan D.'s comment):

strace -e open -p 12345

Note: you can also trace quickly running processes with strace -e open <command>.

edited Mar 20 '17 at 10:17

Community

1

answered Oct 20 '11 at 14:33

Jens Erat

17,507
14
61
74

output is not friendly and too much extra things. – MA1 Oct 21 '11 at 07:39
You can fix that by piping - `strace -p {pid} | grep -i "Open" | tee files_opened.log`. The key is `grep`, which lets you filter the output for the system call you want (e.g. `open()`). – Mar 08 '12 at 10:26
11

@Ninefingers Actually `strace` can do that better than `grep` with the `-e` option: `strace -e open` – Dan D. Mar 08 '12 at 10:48
@DanD oh yeah, ofc :) – Mar 08 '12 at 10:51
When I kill the strace command, it also kills the thing it is tracing. Why is this happening (cygwin)? – CMCDragonkai May 01 '15 at 05:52
Sounds like a bug. Be aware that the cygwin-`strace` is probably not the Linux-`strace`, as `strace` is a Linux-specific tool. Cygwin builds a Unix-compatiblity layer, and does not try to be Linux. With cygwin, you're probably better off using the original Windows tools. – Jens Erat May 01 '15 at 08:36

score 8 · Answer 2 · answered Mar 04 '15 at 08:18

8

The new utility fatrace will do this: https://launchpad.net/fatrace/

sudo fatrace | grep '(6514)'

Don't use the -p option, it means the opposite of what it means in lsof or other utilities.

answered Mar 04 '15 at 08:18

Bryce

2,334
3
22
24

jcalfee314 · Answer 3 · 2014-02-18T14:22:24.253

3

This will loop re-running your command and clearing the screen each time:

watch "lsof -p 12345"

WARNING: this will miss quick file accesses and is only suitable to see long standing files

edited Feb 18 '14 at 14:22

answered Dec 05 '13 at 15:10

jcalfee314

745
3
9
23

2

This is somewhat clumsy compared to the other answer using `strace`. – David Foerster Dec 05 '13 at 17:32
2

That's inaccurate solution - a process may use files in between executions of `lsof` – Dor Jan 31 '14 at 08:47
@Dor you can set the timing of lsof to sub 1 second and increase it's precision. While it's clumsy compared to others, you are wrong in that it's an inaccurate solution. – Jordon Bedwell Feb 18 '14 at 02:31
If your looking at a long file operation (like a database backup) this may a good simple alternative. – jcalfee314 Feb 18 '14 at 14:21

Continuously monitor files opened/accessed by a process

3 Answers3

Linked