How do I monitor opened files of a process in realtime?
72
votes
1
answer
74543
views
I know I can view the open files of a process using
lsof
*at that moment in time* on my Linux machine. However, a process can open, alter and close a file so quickly that I won't be able to see it when monitoring it using standard shell scripting (e.g. watch
) as explained in ["monitor open process files on linux (real-time)"](https://serverfault.com/questions/219323/monitor-open-process-files-on-linux-real-time) .
So, I think I'm looking for a simple way of auditing a process and see what it has done over the time passed. It would be great if it's also possible to see what network connections it (tried to) make and to have the audit start before the process got time to run without the audit being started.
Ideally, I would like to do this:
sh $ audit-lsof /path/to/executable
4530.848254 OPEN read /etc/myconfig
4530.848260 OPEN write /var/log/mylog.log
4540.345986 OPEN read /home/gert/.ssh/id_rsa 1.2.3.4:80 |
[...]
4541.023485 CLOSE /home/gert/.ssh/id_rsa 1.2.3.4:80 | this when polling
Would this be possible using strace
and some flags to not see every system call?
Asked by gertvdijk
(14517 rep)
Dec 19, 2012, 01:16 PM
Last activity: Feb 20, 2025, 10:40 AM
Last activity: Feb 20, 2025, 10:40 AM