0

Is there any command to track what files are opened / closed / written by program with given PID in real time?

I want to:

  1. run a program,
  2. enable program file operations monitoring,
  3. do some stuff in program,
  4. check what files have been changed in time when I did some stuff.

I need something like lsof, but it should be appending operations info in real-time.

Jezor
  • 63
  • 7
  • 3
    Have you considered `strace`? It would give you all that information. – John1024 Aug 05 '15 at 17:33
  • John: yes, but strace is very complex tool and I don't really know how to extract data that I need. – Jezor Aug 05 '15 at 17:57
  • 1
    I'll agree with you that the strace's output is _ugly_ but `strace` is easy to run and the output is not-that-difficult to interpret. For example, when a line starts with `open(`, then a file is being opened, when a line starts with `write(`, a file is being written to. [Click here for an example of strace output.](http://stackoverflow.com/a/27075334/3030305) I understand, though, if you are hoping to find a nicer more-user-friendly tool. – John1024 Aug 05 '15 at 18:56
  • 1
    If you look at the command-line options for `strace`, you'll see that you can restrict its output; e.g., to just I/O-related operations. – Scott - Слава Україні Aug 06 '15 at 23:59
  • I've finally found a solution better than strace (in my case): https://github.com/ole-tange/tangetools/blob/master/tracefile/tracefile – Jezor Aug 07 '15 at 17:57
  • @Jezor: I invite you to (1) read [How do I recommend software in my answers?](http://meta.superuser.com/q/5329/150988) , and then (2) write up your discovery *as an answer* (below). – Scott - Слава Україні Aug 08 '15 at 02:31

0 Answers0