0

I would like to generate a report or histogram of file access counts, for every file accessed while a process is running. ...And not just files accessed by that process, but ideally all child/grandchild/etc processes as well. (Failing that, a system-wide report would be fine.)

I would also need to specify multiple filesystems to monitor. But, I could get by with running multiple test passes, once per filesystem.

I have googled for phrases such as "linux file access count histogram", but didn't find anything that seemed to match this need.

Is there an existing tool which can accomplish this? I prefer open-source/free software.

Improve this question

2 Answers 2

Reset to default
3
  1. Monitoring file accesses.

You can use the linux auditd daemon to do that.

apt-get install auditd
auditctl -a always,exit -F dir=/var -F pid=1005

And it should start logging (on Ubuntu, to /var/log/audit/audit.log by default) all accesses to files in /var made by pid 1005. You can fine-tune the rules to filter more precisely what you want to log.

  1. Generating reports.

Parsing the audit logs to get statistics can be done with any general purpose log analyzing tool. Logstash+Kibana can do it. Splunk too. Searching for "auditctl log analyzer" leads me to more specialized tools like Audit-gui or Auditd-timeline, but I have no experience with that.

Improve this answer
1
  • This answer sounds just about perfect for my needs. Thank you. I am curious if I can specify multiple '-F dir=' ... I will read the man page.
    – Cognitive Hazard
    Dec 22, 2014 at 19:15
0

if you want to debug something I would,recommend to use strace on the process. Filter strace with -e i.e. strace -eopen and redirect the out to a file. Then take the trace parse the open requests and make the histogram by a script.

Improve this answer
1
  • Will this approach also capture activity by child and grandchild processes? And, do you have any sense of how well this performs, compared with @Matt Benzene's suggestion of auditd?
    – Cognitive Hazard
    Dec 22, 2014 at 19:14

Not the answer you're looking for? Browse other questions tagged .