File monitor (like Sysinternal's Filemon) for Linux?

Question

Is there a file monitor, similar to FileMon from Sysinternals, for Linux?

I know about lsof, but this only shows me the files that were opened at the point I've executed it.

Answer 1

Here is another application that does something related: http://archive09.linux.com/feature/124903. It's called kfsmd.

Here's an example of it in action:

$ mkdir /tmp/k
$ cd /tmp/k
$ date > df1.txt
$ date > df2.txt
$ kernel-filesystem-monitor-daemon-cat -v  watch .
setting up watch for:.
setting up watches
calling run
event on wd:1 . filename:df5.txt
CLOSE  URL:./df5.txt
event on wd:1 . filename:df5.txt
DELETE_FILE  URL:./df5.txt

Answer 2

The audit subsystem can tell you all sorts of things.

Answer 3

SystemTap provides free software (GPL) infrastructure to simplify the gathering of information about the running Linux system. This assists diagnosis of a performance or functional problem. SystemTap eliminates the need for the developer to go through the tedious and disruptive instrument, recompile, install, and reboot sequence that may be otherwise required to collect data.

SystemTap provides a simple command line interface and scripting language for writing instrumentation for a live running kernel. We are publishing samples, as well as enlarging the internal "tapset" script library to aid reuse and abstraction.

Among other tracing/probing tools, SystemTap is the tool of choice for complex tasks that may require live analysis, programmable on-line response, and whole-system symbolic access. SystemTap can also handle simple tracing jobs.

http://sourceware.org/systemtap/

Answer 4

bit late for an answer but have a look at this:

http://glsof.sourceforge.net

there is a filemonitor application that works in a similar way to Sysinternals' Filemon

Answer 5

On the command line strace and ltrace may be what you want.