For a PHP website I'm monitoring, I need to see what files are being used each time the browser makes a request.

I thought of using find . -type f -amin 1.
With that I get all files which were read in the last minute (it's a developing server so only I am using the website).

I took care of removing the noatime attribute from the mounting point.
However there must be something else that's preventing the kernel from reading the actual files on disk because the access time is not being updated when I read a file.
I guess it must be the file-system cache which is retrieving the files from memory.

Is there a way to disable file caching under a specific directory? (public_html in my case)

Also I read somewhere that there is the nobh mounting atributes which apparently disables file caching under that mounting point, but I'm not sure.

  • 1
    Are you trying to monitor PHP includes? If so, do you have a bytecode cache installed, such as APC? The bytecode cache may simply be calling stat on the file and using its own internal cache instead of touching the file. Also, if monitoring includes is your goal, and you can install extensions, check out inclued. – Charles Sep 26 '12 at 19:53
  • @Charles, Nope, I have no php caching module installed. And I'd rather avoid installing extension since I need to do this for other machines too. – GetFree Sep 26 '12 at 20:08

Why not look at the apache logs? It lists each file that gets accessed with a timestamp as well as who accessed it.

If you must use atime, note the following from wikipedia page on stat system call:

Linux kernel developer Ingo Molnár called atime "perhaps the most stupid Unix design idea of all times," adding: "Think about this a bit: 'For every file that is read from the disk, let's do a ... write to the disk! And, for every file that is already cached and which we read from the cache ... do a write to the disk!'" He further emphasized the performance impact thus:

atime updates are by far the biggest I/O performance deficiency that Linux has today. Getting rid of atime updates would give us more everyday Linux performance than all the pagecache speedups of the past 10 years, combined.

Current versions of Linux support four mount options, which can be specified in fstab:

strictatime (formerly atime, and formerly the default; strictatime as of 2.6.30) – always update atime
relatime ("relative atime", introduced in 2.6.20 and the default as of 2.6.30) – only update atime under certain circumstances (explained below)
nodiratime – never update atime of directories, but do update atime of other files
noatime – never update atime of any file or directory; implies nodiratime; highest performance, but least compatible
  • I'm aware of the huge performace impact. That's ok, it's just a developing server. – GetFree Sep 26 '12 at 20:18
  • 1
    If you need to track access to specific files and you cannot wrap the access in your own code (which is REALLY simple to do) then you could always use inotify. – symcbean Sep 26 '12 at 20:38
  • Does the 'strictatime' setting work for you if want to use atime? – Ed King Sep 26 '12 at 20:45
  • Yes, strictatime did the trick. It wasn't enough to remove noatime. Thanks. – GetFree Sep 26 '12 at 20:47

For a PHP website I'm monitoring, I need to see what files are being used each time the browser makes a request.

Unless I am missing something, you could simply tail the server log.

For Apache:

tail -f /var/log/httpd/access_log

If PHP is reading other files not included in the browser's request (includes and the like), you could turn on auditing.

auditctl -w /path/to/watch -p r -k php-access

You would only be interested in reads by PHP.

ausearch -k php-access -ui <uid php uses>

  • This is not a static website, it's a PHP system. For every browser request many PHP files are used. – GetFree Sep 26 '12 at 19:56
  • 1
    I get that... If the browser issues a GET for /index.php, HTML is returned with other resources contained and issues subsequent GETs for each. If that's all you need, the access_log will do. If you are looking for includes and other back-end stuff, try auditing. – Aaron Copley Sep 26 '12 at 20:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.