Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am aware of using lsof for checking the files currently accessed by a process. Does there exist a way to see all files that an application opens in its lifetime?

share|improve this question
up vote 17 down vote accepted

Using the strace command it migh be possible with something like :

strace -e trace=open program [arguments]
share|improve this answer
This will show all files that a process tried to access. One might think that something like strace -e trace=open program [arguments] | grep -v ' = -1 ENOENT' could improve the situation, but it's not true either. The latter will fail to detect unfinished and then resumed calls to open. – noxmetus Jan 19 at 0:20

I'm not sure I have understood exactly what you want to do with this. But, have you considered strace ? It displays all system calls including files.

EDIT : Don't forget the -f option that allows you to follow forked processes.

share|improve this answer
Debugging which configuration files are read by an application – Peter Smit May 4 '10 at 10:41

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.