Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there any tool/command available in unix to monitor read/writes in a particular file.

I also want to collect how much data is being read each time the file is accessed.

share|improve this question

migrated from Feb 11 '11 at 12:22

This question came from our site for professional and enthusiast programmers.

What variety of Unix? – Dennis Williamson Feb 11 '11 at 14:22

Short answer, none that I know of.

vmstat (run vmstat 1 to get an immediate idea of what it does; ^C to quit) can show you the complete system IO use (BI and BO columns, blocks in and blocks out, are probably most immediately useful). I find it very useful on mostly-quiet systems.

strace (run strace -o /tmp/ls ls /tmp; then look at /tmp/ls file to see what data it gives you) would let you follow the execution path of your program through all the write() calls, and add up the requested sizes for whichever file descriptor you are interested in. On the plus side, it could be scripted and would be specifically for that program for that file. On the downside, it would slow down execution of your program (perhaps it would run very slowly), and it would completely miss all disk IO that uses mmap(2) memory regions.

You could write a library that you would load with LD_PRELOAD environment variable to replace read(2) and write(2) with wrappers that perform your accounting and wind up calling the system calls (this is almost certainly not worth the hassle). It would also fail to see disk IO that uses mmap(2). You'd have to have an awful good reason to go this route.

You could write a FUSE backend to do your accounting. It'd be slow, and it would slow down every process using that filesystem. The FUSE code also exposes a lot of kernel internals that expect fast results to arbitrarily long (and glacially long, by kernel standards) delays due to userspace programs. Programs might cause memory pressure, swapping, and further disk traffic. FUSE is best deployed in environments with plentiful memory, non-realtime requirements, and low cost of failure.

share|improve this answer

THere is fam,, but not sure if its available for your OS

Also google inotify.

share|improve this answer

In linux there have been several APIs for monitoring file system activity previously (dnotify and inotify), but the latest one is called fanotify. LWN discuss the API here.

For monitoring whole file systems there is iostat, what you ask for seems to be somewhat like iostat but only for a given file. I am not aware of such a combination, but by using the API you can write your own.

share|improve this answer
Why was this modded down? I used inotify in the past, and it was pretty cool? – ajstein May 4 '11 at 10:08

On Linux you can use incron. On Solaris/BSD you'll probably be able to get the information using DTrace.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.