I am aware of using lsof for checking the files currently accessed by a process. Does there exist a way to see all files that an application opens in its lifetime?
-
1Continuously monitor files opened/accessed by a process – phuclv May 22 '17 at 3:37
Add a comment
|
Using the strace command it migh be possible with something like :
strace -e trace=open program [arguments]
-
This will show all files that a process tried to access. One might think that something like
strace -e trace=open program [arguments] | grep -v ' = -1 ENOENT'could improve the situation, but it's not true either. The latter will fail to detect unfinished and then resumed calls toopen. – facetus Jan 19 '16 at 0:20 -
2
I'm not sure I have understood exactly what you want to do with this. But, have you considered strace ? It displays all system calls including files.
EDIT : Don't forget the -f option that allows you to follow forked processes.
answered May 4 '10 at 7:36
-
1
