Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a file monitor, similar to FileMon from Sysinternals, for Linux?

I know about lsof, but this only shows me the files that were opened at the point I've executed it.

share|improve this question
r u looking for file::monitor -> – thegeek Jul 6 '10 at 10:13
File::Monitor, FAM, Gamin, inotify, etc. are all related, but don't sound like what Simon is asking for. Filemon lets you see all file operations on the whole system, whereas File::Monitor, etc are more for watching for file events on a single file or directory AFAIUI. – Mikel Dec 24 '10 at 3:56

The audit subsystem can tell you all sorts of things.

share|improve this answer
Including all opened files and the responsible processes? Is there some kind of user interface for audit? – Simon A. Eugster Jul 7 '10 at 13:32
audit works at the kernel level, so it catches everything. There probably is no user interface for it. You will need to use the command line tools, or come up with your own user interface. – Ignacio Vazquez-Abrams Jul 7 '10 at 14:02
You can do one-off queries using ausearch and aureport, but if you want all information in real-time, then you have to write your own program. There's more information at the audit home page <>;, but it's not easy to do. – Mikel Dec 24 '10 at 3:54
Why is the Linux equivalent of everything a command-line tool that you can't use until you've read and re-read several manpages? – Pieter Sep 30 '11 at 18:01
Because usually said command is extremely powerful and flexible, and will let you "shoot yourself in the foot." – LawrenceC Aug 8 '12 at 17:03

A tool that works on Linux in similar way as the Sysinternals software can be found here: It is an agent based, real-time file monitor for both Windows and Linux that can give you relevant details about various file operations, including the user name and process.

Note: I work for the company which develops this product.

Screenshot of the product

share|improve this answer

On the command line strace and ltrace may be what you want.

share|improve this answer
Can I somehow make strace/ltrace to monitor all available processes? So far I've only managed to get infos about one process (-p PID). – Simon A. Eugster Jul 7 '10 at 13:28
No, you can only trace one process (and its children, using -f) – Florian Diesch Jul 7 '10 at 14:35
Your answer is without detail and hard to fully understand. Please consider revising your answer to provide more detail. For example what do these do exactly and how do you use them properly? – KronoS Jul 13 '12 at 4:21

SystemTap provides free software (GPL) infrastructure to simplify the gathering of information about the running Linux system. This assists diagnosis of a performance or functional problem. SystemTap eliminates the need for the developer to go through the tedious and disruptive instrument, recompile, install, and reboot sequence that may be otherwise required to collect data.

SystemTap provides a simple command line interface and scripting language for writing instrumentation for a live running kernel. We are publishing samples, as well as enlarging the internal "tapset" script library to aid reuse and abstraction.

Among other tracing/probing tools, SystemTap is the tool of choice for complex tasks that may require live analysis, programmable on-line response, and whole-system symbolic access. SystemTap can also handle simple tracing jobs.

share|improve this answer

bit late for an answer but have a look at this:

there is a filemonitor application that works in a similar way to Sysinternals' Filemon

share|improve this answer

Here is another application that does something related: It's called kfsmd.

Here's an example of it in action:

$ mkdir /tmp/k
$ cd /tmp/k
$ date > df1.txt
$ date > df2.txt
$ kernel-filesystem-monitor-daemon-cat -v  watch .
setting up watch for:.
setting up watches
calling run
event on wd:1 . filename:df5.txt
CLOSE  URL:./df5.txt
event on wd:1 . filename:df5.txt
DELETE_FILE  URL:./df5.txt
share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .