How do I log file system read/writes by filename in Linux?

Question

I'm looking for a simple method that will log file system operations. It should display the name of the file being accessed or modified.

I'm familiar with powertop, and it appears this works to an extent, in so much that it show the user files that were written to. Is there any other utilities that support this feature.

Some of my findings:

powertop: best for write access logging, but more focused on CPU activity
iotop: shows real time disk access by process, but not file name
lsof: shows the open files per process, but not real time file access
iostat: shows the real time I/O performance of disk/arrays but does not indicate file or process

Answer 1

So far iotop is the best overall solution. The following command gives you a real-time output of all the processes using the disk.

iotop -bktqqq -d .5  | grep -v "[0].00 K/s    0.00 K/s"

where: -b    is batch mode
       -k    is kilobytes/s
       -t    adds timestamp
       -qqq  removes output headers
       -d .5 updates every .5 seconds

and 'grep -v ...' filters all the idle processes from the output

Evenutaly you will notice that process will be accessing the disk. The simple way to investigate is to stop the process, and start it with strace. For example:

sudo strace -f nmbd -D

This will show you syscalls of the file system access.

Another option is http://linux.die.net/man/7/inotify where many distributions provide "inotify-tools" so you can watch a path via

inotifywait -r -m /<path you want to watch>

Answer 2

For logging (rather than monitoring) you should consider using the Linux audit daemon introduced in kernel 2.6.

Answer 3

Here there is another option, where many distributions provide "inotify-tools" so you can watch a path via:

inotifywait -r -m /<path you want to watch>

Answer 4

#!/usr/bin/perl
use Cwd;
use File::Touch;
use File::Temp qw/tempfile/;
use Time::HiRes qw/sleep time alarm/;
use Term::ReadKey;
my ($wchar, $hchar, $wpixels, $hpixels) = GetTerminalSize();
if($hchar < 10) {print "please increase window size"; exit; }
my $mydir = getcwd;
my  ($fh, $tmpfile) = tempfile(UNLINK => 1);

while(1)
   {
   my $starttime = time;
   eval {
        local $SIG{ALRM} = sub { die "alarm\n" };
        alarm 0.4;
        $query = `find -neweraa $tmpfile 2>&1`; #change to mm for writes only
        touch($tmpfile);
        @files = split(/\n/,$query);
        alarm 0;
        };
   system('clear');
   foreach $file(@files) { $filecount{$file}++; }
   @sorted = sort {$filecount{$b} <=> $filecount{$a}} (keys %filecount);
   for ($x = 0;$x < $hchar-2; $x++) {print $filecount{$sorted[$x]}."\t".$sorted[$x]."\n";}
   my $endtime = time;
   my $length = ($endtime-$starttime);
   if ($length > 0.3) {print "program not designed for large trees, please use smaller tree.\n"; exit;}
   print "\n$length"."s\n"
   }