I need to monitor a process to find out what file it is saving it's configuration data in. I can't find the config file, but I know the process. Is there a way to log the files that a process is accessing (including spawned processes also)?
1 Answer
Yes
strace -f -e trace=open ls /etc
-
I ran an app. It showed lots of gui config file references, but when I check and uncheck boxes, it doesn't show the file it saved the configuration in. I thought it might be saving it in ram until shutdown, but upon exiting the app, it still showed no output. So, it must not be showing all files or doing something that is not obvious.– bambuntuMar 1, 2012 at 0:37
-
Maybe it's sending it across dbus or some other interprocess communication mechanism to another process, that actually writes the file. Try just plain
strace
with no-e
and you will get a lot more data. Try-o /tmp/app.trace
to store it to a file.– poolieMar 1, 2012 at 5:04 -
I did research, but still am stumped. I found that a processes open files are stored in /proc/processNumber and the file descripter is in the fd directory. readlink is supposed find the name of the file. I doubled checked the strace lines to make sure a fd wasn't opening and shutting on me that isn't listed in /proc. I am unable at this time to find the file. There is some missing information that would allow me to find the file using strace or readlink.– bambuntuMar 2, 2012 at 12:33
-
Every interaction with the filesystem or the external world will be indicated by strace. (Yes, pedants, I can think of things like mmaped files, but opening the file will still be listed.)– poolieMar 3, 2012 at 1:31