Sample Header Ad - 728x90

How do I monitor opened files of a process in realtime?

72 votes
1 answer
74543 views
I know I can view the open files of a process using lsof *at that moment in time* on my Linux machine. However, a process can open, alter and close a file so quickly that I won't be able to see it when monitoring it using standard shell scripting (e.g. watch) as explained in ["monitor open process files on linux (real-time)"](https://serverfault.com/questions/219323/monitor-open-process-files-on-linux-real-time) . So, I think I'm looking for a simple way of auditing a process and see what it has done over the time passed. It would be great if it's also possible to see what network connections it (tried to) make and to have the audit start before the process got time to run without the audit being started. Ideally, I would like to do this: sh $ audit-lsof /path/to/executable 4530.848254 OPEN read /etc/myconfig 4530.848260 OPEN write /var/log/mylog.log 4540.345986 OPEN read /home/gert/.ssh/id_rsa 1.2.3.4:80 | [...] 4541.023485 CLOSE /home/gert/.ssh/id_rsa 1.2.3.4:80 | this when polling Would this be possible using strace and some flags to not see every system call?
Asked by gertvdijk (14517 rep)
Dec 19, 2012, 01:16 PM
Last activity: Feb 20, 2025, 10:40 AM