3

I know how to strace a certain program to see all the files it reads. I know how to see what processes are using a certain file at the moment.

But is there a way to log all file opens. I want something like tail -f some/log/file but instead lsof -f /file/someone/might/open/soon which prints out info every time something opens that file.

Thanks

2 Answers 2

2

This can be done with an Auditing System. You didn't specify your OS, I assume Linux. Check http://linux.die.net/man/8/auditd and the See also pages at the bottom.

1

You could use inotify to run lsof when the file is accessed. For example, in the incrontab:

/etc/passwd IN_ACCESS /tmp/lsof.sh $@

Incrontab doesn't seem to use the shell, so redirects can't be used. A wrapper can be used instead:

lsof -f -- $1 >> /tmp/lsof.log

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .