Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Is there a file monitor, similar to FileMon from Sysinternals, for Linux?

I know about lsof, but this only shows me the files that were opened at the point I've executed it.

share|improve this question
    
r u looking for file::monitor -> search.cpan.org/~andya/File-Monitor-0.10/lib/File/Monitor.pm –  thegeek Jul 6 '10 at 10:13
    
File::Monitor, FAM, Gamin, inotify, etc. are all related, but don't sound like what Simon is asking for. Filemon lets you see all file operations on the whole system, whereas File::Monitor, etc are more for watching for file events on a single file or directory AFAIUI. –  Mikel Dec 24 '10 at 3:56
add comment

5 Answers

The audit subsystem can tell you all sorts of things.

share|improve this answer
    
Including all opened files and the responsible processes? Is there some kind of user interface for audit? –  Simon A. Eugster Jul 7 '10 at 13:32
    
audit works at the kernel level, so it catches everything. There probably is no user interface for it. You will need to use the command line tools, or come up with your own user interface. –  Ignacio Vazquez-Abrams Jul 7 '10 at 14:02
    
You can do one-off queries using ausearch and aureport, but if you want all information in real-time, then you have to write your own program. There's more information at the audit home page <people.redhat.com/sgrubb/audit/>;, but it's not easy to do. –  Mikel Dec 24 '10 at 3:54
    
Why is the Linux equivalent of everything a command-line tool that you can't use until you've read and re-read several manpages? –  Pieter Sep 30 '11 at 18:01
    
Because usually said command is extremely powerful and flexible, and will let you "shoot yourself in the foot." –  ultrasawblade Aug 8 '12 at 17:03
add comment

On the command line strace and ltrace may be what you want.

share|improve this answer
    
Can I somehow make strace/ltrace to monitor all available processes? So far I've only managed to get infos about one process (-p PID). –  Simon A. Eugster Jul 7 '10 at 13:28
    
No, you can only trace one process (and its children, using -f) –  Florian Diesch Jul 7 '10 at 14:35
    
Your answer is without detail and hard to fully understand. Please consider revising your answer to provide more detail. For example what do these do exactly and how do you use them properly? –  KronoS Jul 13 '12 at 4:21
add comment

SystemTap provides free software (GPL) infrastructure to simplify the gathering of information about the running Linux system. This assists diagnosis of a performance or functional problem. SystemTap eliminates the need for the developer to go through the tedious and disruptive instrument, recompile, install, and reboot sequence that may be otherwise required to collect data.

SystemTap provides a simple command line interface and scripting language for writing instrumentation for a live running kernel. We are publishing samples, as well as enlarging the internal "tapset" script library to aid reuse and abstraction.

Among other tracing/probing tools, SystemTap is the tool of choice for complex tasks that may require live analysis, programmable on-line response, and whole-system symbolic access. SystemTap can also handle simple tracing jobs.

http://sourceware.org/systemtap/

share|improve this answer
add comment

bit late for an answer but have a look at this:

http://glsof.sourceforge.net

there is a filemonitor application that works in a similar way to Sysinternals' Filemon

share|improve this answer
add comment

Here is another application that does something related: http://archive09.linux.com/feature/124903. It's called kfsmd.

Here's an example of it in action:

$ mkdir /tmp/k
$ cd /tmp/k
$ date > df1.txt
$ date > df2.txt
$ kernel-filesystem-monitor-daemon-cat -v  watch .
setting up watch for:.
setting up watches
calling run
event on wd:1 . filename:df5.txt
CLOSE  URL:./df5.txt
event on wd:1 . filename:df5.txt
DELETE_FILE  URL:./df5.txt
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.