3

I need to monitor a process to find out what file it is saving it's configuration data in. I can't find the config file, but I know the process. Is there a way to log the files that a process is accessing (including spawned processes also)?

1
  • It might help if you say what program you're interested in, if this is a generally available program.
    – poolie
    Mar 3, 2012 at 1:30

1 Answer 1

4

Yes

strace -f -e trace=open ls /etc
4
  • I ran an app. It showed lots of gui config file references, but when I check and uncheck boxes, it doesn't show the file it saved the configuration in. I thought it might be saving it in ram until shutdown, but upon exiting the app, it still showed no output. So, it must not be showing all files or doing something that is not obvious.
    – bambuntu
    Mar 1, 2012 at 0:37
  • Maybe it's sending it across dbus or some other interprocess communication mechanism to another process, that actually writes the file. Try just plain strace with no -e and you will get a lot more data. Try -o /tmp/app.trace to store it to a file.
    – poolie
    Mar 1, 2012 at 5:04
  • I did research, but still am stumped. I found that a processes open files are stored in /proc/processNumber and the file descripter is in the fd directory. readlink is supposed find the name of the file. I doubled checked the strace lines to make sure a fd wasn't opening and shutting on me that isn't listed in /proc. I am unable at this time to find the file. There is some missing information that would allow me to find the file using strace or readlink.
    – bambuntu
    Mar 2, 2012 at 12:33
  • Every interaction with the filesystem or the external world will be indicated by strace. (Yes, pedants, I can think of things like mmaped files, but opening the file will still be listed.)
    – poolie
    Mar 3, 2012 at 1:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .