0

I want to be able to take a process on a Linux machine and log every file that it opens, reads, or writes during a certain time window.

For example, let's say that I suspect that Apache is using an incorrect file for some reason. How could I run the request that triggers the file open/read and then get a list of every file that was opened by the Apache process in order to debug it?

2 Answers 2

3

Strace is one way that comes to mind.

This answer discusses it in greater detail:

Can strace show me the filename/path for read/write syscalls

0

Auditd is built for this purpose. You can create simple rules to log specific forms of access by uid, gid, (greater or less than uid/gid), directory, filesystem, etc.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .