Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I want to know which process changed files in some directory.

I had a look at inotify-tools, but it doesn't show the pid. I also look at fileschanged utility, but in my case it doesn't show anything at all, even that change happened.

Is there solution?

share|improve this question

1 Answer 1

up vote 3 down vote accepted

Take a look at fatrace written by Martin Pitt.

It will monitor all system-wide reads/writes/opens/closes alongside the PIDs and the names of their processes.

  1. Get it:

    bzr branch lp:fatrace
    
  2. Build it:

    cd fatrace
    make
    
  3. Run it:

    sudo ./fatrace -t | grep "/path/to/your/file"
    
share|improve this answer
    
great tool, thanks! it would be better if I could make inotify tell process id, but if it's not possible, then I will use fatrace –  damluar Feb 18 '12 at 9:45

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.