1

I want to know what files a process accesses. strace can provide me with that information, but the output of strace is rather "raw". Is there anything that provides similar functionality, but in a more human readable fashion (i.e. filter out libraries, highlight files in the $HOME directory, provide statistics on how often stuff is accessed, etc.)?

3

A guy called Ole Tange coded the tool that you're describing. Take a look here https://gitlab.com/ole.tange/tangetools/tree/master/tracefile. The tracefile is essentially a shell script, so make it executable and run it. The .pod file is a manual that describes how to use it.

1

fatrace

Install the fatrace package:

sudo apt install fatrace

NAME fatrace - report system wide file access events

SYNOPSIS fatrace [ OPTIONS ]

DESCRIPTION fatrace reports file access events from all running processes.

It does not report file access by fatrace itself, to avoid logging events caused by writing the output into a file. It also ignores events on virtual and kernel file systems such as sysfs, proc, and devtmpfs.

Its main purpose is to find processes which keep waking up the disk unnecessarily and thus prevent some power saving.

By default, events are reported to stdout. This will cause some loops if you run this tool in e. g. gnome-terminal, as this causes a disk access for every output line. To avoid this, redirect the output into a file.

OUTPUT FORMAT
A typical event looks like

   rsyslogd(875): W /var/log/auth.log  
   compiz(1971): O device 8:2 inode 658203

The line has the following fields:

  • Process name. This is read from /proc/pid/comm, and might be abbreviated for long process names.

  • Process ID

  • Event type: Open, Read, Write, or Close. Combinations are possible, such as CW for closing a written file.

  • Affected file. In some cases the path and name cannot be determined, e. g. because it is a temporary file which is already deleted. In that case, it prints the devices' major and minor number and the inode number. To examine such a process in more detail, you should consider using strace(1).

If you specify the --timestamp option, the first field will be the current time.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.