Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Is there a way in the linux to find files which were accessed (read, write, doesn't matter) during computer boot and work? Or even better files that were NOT accessed at all during some time? I know there is a find / -atime +60 (for example for older than 60 days files) command, but problem is that in this system the modification of atime attribute for files is disabled as it works from flashcard. So i need some other way to find those files.

share|improve this question

migrated from stackoverflow.com Dec 16 '10 at 12:53

This question came from our site for professional and enthusiast programmers.

4  
Consider accepting correct answers to your questions. Also, upvote useful answers. –  Alberto Zaccagni Dec 15 '10 at 17:03
    
Sure i will. I can't upvote answers yet, system doesn't allow it for me. –  lugger1 Dec 15 '10 at 19:19

1 Answer 1

For files accessed during boot, I'd start with ureadahead:

$ sudo ureadahead --dump | grep /

which dumps the content of /var/lib/ureadahead/pack where the profiled boot file accesses are stored.

Otherwise there are lots of ways to monitor file access:

bootchart might be helpful to visualize what's happening during boot.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.