Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a way in the linux to find files which were accessed (read, write, doesn't matter) during computer boot and work? Or even better files that were NOT accessed at all during some time? I know there is a find / -atime +60 (for example for older than 60 days files) command, but problem is that in this system the modification of atime attribute for files is disabled as it works from flashcard. So i need some other way to find those files.

share|improve this question

migrated from Dec 16 '10 at 12:53

This question came from our site for professional and enthusiast programmers.

Consider accepting correct answers to your questions. Also, upvote useful answers. – Alberto Zaccagni Dec 15 '10 at 17:03
Sure i will. I can't upvote answers yet, system doesn't allow it for me. – lugger1 Dec 15 '10 at 19:19

For files accessed during boot, I'd start with ureadahead:

$ sudo ureadahead --dump | grep /

which dumps the content of /var/lib/ureadahead/pack where the profiled boot file accesses are stored.

Otherwise there are lots of ways to monitor file access:

bootchart might be helpful to visualize what's happening during boot.

share|improve this answer

You must log in to answer this question.