Let me suggest an alternative with sysdig as the answers above are aging. Let display the
name of the processes that delete the file
/tmp/test. First we create the file with
touch /tmp/test. Then we start
sysdig with the following filter:
$ sudo sysdig -p'%proc.pid,%proc.name' '(evt.type=unlinkat and (evt.arg.name=test or evt.arg.name=/tmp/test)) or (evt.type=unlink and evt.arg.path=/tmp/test)'
unlinkat(2) requires an
or filter if the path (e.g.
evt.arg.name) may be relative. To handle both
unlink (which calls
rm (which calls
unlinkat(2) in its GNU version), the filter should match both syscalls.
sysdig should be running when a process deletes the file. Then when we execute such commands:
$ unlink /tmp/test
$ touch /tmp/test
$ rm /tmp/test
$ cd /tmp; touch test; rm test
It will displays such an output:
Please refer to the sysdig user guide for an explanation about filtering and output.
As the filter is pretty long, I found it convenient to write a chisel. It is a lua script that is associated with a
description = "displays processes that delete a file"
short_description = "spy file deletion"
category = "files"
name = "path",
description = "the path of the file to monitor",
argtype = "string"
function on_set_arg(name, val)
path = val
local filename = path
for i in string.gmatch(path, "[^/]+") do
filename = i
"(evt.type=unlinkat and (evt.arg.name=" .. path .. " or \
evt.arg.name=" .. filename .. ")) or \
(evt.type=unlink and evt.arg.path=" .. path .. ")")
Feel free to comment and improve it. You can put the lua script in a
spy_deletes.lua file inside a directory and execute
sysdig in this directory to make the chisel available. When typing
sudo sysdig -cl you will see it as:
spy_deletes spy file deletion
Now you can call it:
$ sudo sysdig -c spy_deletes /tmp/test
And in another terminal type:
$ touch test; unlink test
$ touch test; unlink /tmp/test
$ touch test; rm test
$ touch test; rm /tmp/test
It will output:
unlinkat filter would deserve to be more accurate and only match the absolute path. This would require to retrieve the fd of the directory passed to