I am aware of using lsof for checking the files currently accessed by a process. Does there exist a way to see all files that an application opens in its lifetime?


Using the strace command it migh be possible with something like :

strace -e trace=open program [arguments]
  • This will show all files that a process tried to access. One might think that something like strace -e trace=open program [arguments] | grep -v ' = -1 ENOENT' could improve the situation, but it's not true either. The latter will fail to detect unfinished and then resumed calls to open. – facetus Jan 19 '16 at 0:20
  • 2
    Note that the signal you need might be openat. – merlinND Mar 5 '19 at 13:20

I'm not sure I have understood exactly what you want to do with this. But, have you considered strace ? It displays all system calls including files.

EDIT : Don't forget the -f option that allows you to follow forked processes.

  • 1
    Debugging which configuration files are read by an application – Peter Smit May 4 '10 at 10:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.