Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I know how to strace a certain program to see all the files it reads. I know how to see what processes are using a certain file at the moment.

But is there a way to log all file opens. I want something like tail -f some/log/file but instead lsof -f /file/someone/might/open/soon which prints out info every time something opens that file.


share|improve this question

This can be done with an Auditing System. You didn't specify your OS, I assume Linux. Check and the See also pages at the bottom.

share|improve this answer

You could use inotify to run lsof when the file is accessed. For example, in the incrontab:

/etc/passwd IN_ACCESS /tmp/ $@

Incrontab doesn't seem to use the shell, so redirects can't be used. A wrapper can be used instead:

lsof -f -- $1 >> /tmp/lsof.log
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.