I need to monitor a process to find out what file it is saving it's configuration data in. I can't find the config file, but I know the process. Is there a way to log the files that a process is accessing (including spawned processes also)?

  • It might help if you say what program you're interested in, if this is a generally available program. – poolie Mar 3 '12 at 1:30


strace -e trace=open ls /etc
  • I ran an app. It showed lots of gui config file references, but when I check and uncheck boxes, it doesn't show the file it saved the configuration in. I thought it might be saving it in ram until shutdown, but upon exiting the app, it still showed no output. So, it must not be showing all files or doing something that is not obvious. – bambuntu Mar 1 '12 at 0:37
  • Maybe it's sending it across dbus or some other interprocess communication mechanism to another process, that actually writes the file. Try just plain strace with no -e and you will get a lot more data. Try -o /tmp/app.trace to store it to a file. – poolie Mar 1 '12 at 5:04
  • I did research, but still am stumped. I found that a processes open files are stored in /proc/processNumber and the file descripter is in the fd directory. readlink is supposed find the name of the file. I doubled checked the strace lines to make sure a fd wasn't opening and shutting on me that isn't listed in /proc. I am unable at this time to find the file. There is some missing information that would allow me to find the file using strace or readlink. – bambuntu Mar 2 '12 at 12:33
  • Every interaction with the filesystem or the external world will be indicated by strace. (Yes, pedants, I can think of things like mmaped files, but opening the file will still be listed.) – poolie Mar 3 '12 at 1:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.