Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I know how to strace a certain program to see all the files it reads. I know how to see what processes are using a certain file at the moment.

But is there a way to log all file opens. I want something like tail -f some/log/file but instead lsof -f /file/someone/might/open/soon which prints out info every time something opens that file.

Thanks

share|improve this question
add comment

2 Answers

This can be done with an Auditing System. You didn't specify your OS, I assume Linux. Check http://linux.die.net/man/8/auditd and the See also pages at the bottom.

share|improve this answer
add comment

You could use inotify to run lsof when the file is accessed. For example, in the incrontab:

/etc/passwd IN_ACCESS /tmp/lsof.sh $@

Incrontab doesn't seem to use the shell, so redirects can't be used. A wrapper can be used instead:

lsof -f -- $1 >> /tmp/lsof.log
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.