23

Is there a file monitor, similar to FileMon from Sysinternals, for Linux?

I know about lsof, but this only shows me the files that were opened at the point I've executed it.

2
  • r u looking for file::monitor -> search.cpan.org/~andya/File-Monitor-0.10/lib/File/Monitor.pm
    – thegeek
    Jul 6, 2010 at 10:13
  • 1
    File::Monitor, FAM, Gamin, inotify, etc. are all related, but don't sound like what Simon is asking for. Filemon lets you see all file operations on the whole system, whereas File::Monitor, etc are more for watching for file events on a single file or directory AFAIUI.
    – Mikel
    Dec 24, 2010 at 3:56

6 Answers 6

6

A tool that works on Linux in similar way as the Sysinternals software can be found here: http://temasoft.com/products/filemonitor. It is an agent based, real-time file monitor for both Windows and Linux that can give you relevant details about various file operations, including the user name and process.

Note: I work for the company which develops this product.

Screenshot of the product

0
4

The audit subsystem can tell you all sorts of things.

5
  • 1
    Including all opened files and the responsible processes? Is there some kind of user interface for audit? Jul 7, 2010 at 13:32
  • audit works at the kernel level, so it catches everything. There probably is no user interface for it. You will need to use the command line tools, or come up with your own user interface. Jul 7, 2010 at 14:02
  • You can do one-off queries using ausearch and aureport, but if you want all information in real-time, then you have to write your own program. There's more information at the audit home page <people.redhat.com/sgrubb/audit>, but it's not easy to do.
    – Mikel
    Dec 24, 2010 at 3:54
  • 2
    Why is the Linux equivalent of everything a command-line tool that you can't use until you've read and re-read several manpages?
    – Pieter
    Sep 30, 2011 at 18:01
  • Because usually said command is extremely powerful and flexible, and will let you "shoot yourself in the foot."
    – LawrenceC
    Aug 8, 2012 at 17:03
3

Here is another application that does something related: http://archive09.linux.com/feature/124903. It's called kfsmd.

Here's an example of it in action:

$ mkdir /tmp/k
$ cd /tmp/k
$ date > df1.txt
$ date > df2.txt
$ kernel-filesystem-monitor-daemon-cat -v  watch .
setting up watch for:.
setting up watches
calling run
event on wd:1 . filename:df5.txt
CLOSE  URL:./df5.txt
event on wd:1 . filename:df5.txt
DELETE_FILE  URL:./df5.txt
2

On the command line strace and ltrace may be what you want.

3
  • Can I somehow make strace/ltrace to monitor all available processes? So far I've only managed to get infos about one process (-p PID). Jul 7, 2010 at 13:28
  • No, you can only trace one process (and its children, using -f) Jul 7, 2010 at 14:35
  • 2
    Your answer is without detail and hard to fully understand. Please consider revising your answer to provide more detail. For example what do these do exactly and how do you use them properly? Jul 13, 2012 at 4:21
2

SystemTap provides free software (GPL) infrastructure to simplify the gathering of information about the running Linux system. This assists diagnosis of a performance or functional problem. SystemTap eliminates the need for the developer to go through the tedious and disruptive instrument, recompile, install, and reboot sequence that may be otherwise required to collect data.

SystemTap provides a simple command line interface and scripting language for writing instrumentation for a live running kernel. We are publishing samples, as well as enlarging the internal "tapset" script library to aid reuse and abstraction.

Among other tracing/probing tools, SystemTap is the tool of choice for complex tasks that may require live analysis, programmable on-line response, and whole-system symbolic access. SystemTap can also handle simple tracing jobs.

http://sourceware.org/systemtap/

2

bit late for an answer but have a look at this:

http://glsof.sourceforge.net

there is a filemonitor application that works in a similar way to Sysinternals' Filemon

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .