up vote 6 down vote favorite
2
share [g+] share [fb]

Is there a file monitor, similar to FileMon from Sysinternals, for Linux?

I know about lsof, but this only shows me the files that were opened at the point I've executed it.

link|improve this question
r u looking for file::monitor -> search.cpan.org/~andya/File-Monitor-0.10/lib/File/Monitor.pm – thegeek Jul 6 '10 at 10:13
File::Monitor, FAM, Gamin, inotify, etc. are all related, but don't sound like what Simon is asking for. Filemon lets you see all file operations on the whole system, whereas File::Monitor, etc are more for watching for file events on a single file or directory AFAIUI. – Mikel Dec 24 '10 at 3:56
feedback

4 Answers

up vote 1 down vote

The audit subsystem can tell you all sorts of things.

link|improve this answer
Including all opened files and the responsible processes? Is there some kind of user interface for audit? – Simon A. Eugster Jul 7 '10 at 13:32
audit works at the kernel level, so it catches everything. There probably is no user interface for it. You will need to use the command line tools, or come up with your own user interface. – Ignacio Vazquez-Abrams Jul 7 '10 at 14:02
You can do one-off queries using ausearch and aureport, but if you want all information in real-time, then you have to write your own program. There's more information at the audit home page <people.redhat.com/sgrubb/audit/>;, but it's not easy to do. – Mikel Dec 24 '10 at 3:54
Why is the Linux equivalent of everything a command-line tool that you can't use until you've read and re-read several manpages? – Pieter Sep 30 '11 at 18:01
feedback
up vote 1 down vote

bit late for an answer but have a look at this:

http://glsof.sourceforge.net

there is a filemonitor application that works in a similar way to Sysinternals' Filemon

link|improve this answer
feedback
up vote 0 down vote

On the command line strace and ltrace may be what you want.

link|improve this answer
Can I somehow make strace/ltrace to monitor all available processes? So far I've only managed to get infos about one process (-p PID). – Simon A. Eugster Jul 7 '10 at 13:28
No, you can only trace one process (and its children, using -f) – Florian Diesch Jul 7 '10 at 14:35
feedback
up vote 0 down vote

SystemTap provides free software (GPL) infrastructure to simplify the gathering of information about the running Linux system. This assists diagnosis of a performance or functional problem. SystemTap eliminates the need for the developer to go through the tedious and disruptive instrument, recompile, install, and reboot sequence that may be otherwise required to collect data.

SystemTap provides a simple command line interface and scripting language for writing instrumentation for a live running kernel. We are publishing samples, as well as enlarging the internal "tapset" script library to aid reuse and abstraction.

Among other tracing/probing tools, SystemTap is the tool of choice for complex tasks that may require live analysis, programmable on-line response, and whole-system symbolic access. SystemTap can also handle simple tracing jobs.

http://sourceware.org/systemtap/

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.