Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free.

I am working on a project related to VM migration. Sometimes the VM image will disappear and I just want to know who the culprit is. I tried strace on suspicious processes but to no avail.

share|improve this question
I was hoping to find a way to trace unlink system call on every process instead of just one but I guess there is no easy way to do this... –  Mohammad Jun 15 '11 at 12:28

2 Answers 2

up vote 6 down vote accepted

Finally I found the answer here: http://www.cyberciti.biz/tips/linux-audit-files-to-see-who-made-changes-to-a-file.html

The Linux Audit daemon will do the trick.

sudo auditctl -w /path/to/somefile -p wra

and then

ausearch -f /path/to/somefile -i
share|improve this answer
nice, but how does it affect performance? –  vartec Jun 22 '11 at 11:56

You can find out the PID of a process, which has some file open using lsof.

Once file is closed and deleted, you cannot get that information.

BTW. Keep in mind, that deleting a file is operation on directory it's in, not on a file itself.

share|improve this answer
Unfortunately there is no need to open a file to delete it. At least for example "strace rm some-file" output doesn't show that rm command first open the file and then delete it. So I guess lsof is not helpful. –  Mohammad Jun 15 '11 at 12:35
Read the last sentence of my answer –  vartec Jun 15 '11 at 13:29

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.