Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to know which process changed files in some directory.

I had a look at inotify-tools, but it doesn't show the pid. I also look at fileschanged utility, but in my case it doesn't show anything at all, even that change happened.

Is there solution?

share|improve this question
up vote 4 down vote accepted

Take a look at fatrace written by Martin Pitt.

It will monitor all system-wide reads/writes/opens/closes alongside the PIDs and the names of their processes.

  1. Get it:

    bzr branch lp:fatrace
    
  2. Build it:

    cd fatrace
    make
    
  3. Run it:

    sudo ./fatrace -t | grep "/path/to/your/file"
    
share|improve this answer
    
great tool, thanks! it would be better if I could make inotify tell process id, but if it's not possible, then I will use fatrace – damluar Feb 18 '12 at 9:45
    
What if you want to run it as a daemon? I tried sudo fatrace/fatrace -t | grep "/home/eric/test.txt" >> ./monitor.txt & but nothing gets inserted into monitor.txt – etang Jan 7 at 21:59

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.