Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

lsof -p 12345 will list all the files opened by process whose pid is 12345 but only for a particular instant of time.

How can we continuously monitor a process from the start to end(until process is terminated) to list/show every single file accessed by the process during its whole lifetime?

share|improve this question
up vote 22 down vote accepted

Try with strace -p 12345; it should do what you are trying to achieve.

The output can be filtered to only display opened files (Dan D.'s comment):

strace -e open -p 12345

Note: you can also trace quickly running processes with strace -e open <command>.

share|improve this answer
output is not friendly and too much extra things. – MA1 Oct 21 '11 at 7:39
You can fix that by piping - strace -p {pid} | grep -i "Open" | tee files_opened.log. The key is grep, which lets you filter the output for the system call you want (e.g. open()). – user26996 Mar 8 '12 at 10:26
@Ninefingers Actually strace can do that better than grep with the -e option: strace -e open – Dan D. Mar 8 '12 at 10:48
@DanD oh yeah, ofc :) – user26996 Mar 8 '12 at 10:51
When I kill the strace command, it also kills the thing it is tracing. Why is this happening (cygwin)? – CMCDragonkai May 1 '15 at 5:52

The new utility fatrace will do this:

sudo fatrace | grep '(6514)'

Don't use the -p option, it means the opposite of what it means in lsof or other utilities.

share|improve this answer

This will loop re-running your command and clearing the screen each time:

watch "lsof -p 12345"

WARNING: this will miss quick file accesses and is only suitable to see long standing files

share|improve this answer
This is somewhat clumsy compared to the other answer using strace. – David Foerster Dec 5 '13 at 17:32
That's inaccurate solution - a process may use files in between executions of lsof – Dor Jan 31 '14 at 8:47
@Dor you can set the timing of lsof to sub 1 second and increase it's precision. While it's clumsy compared to others, you are wrong in that it's an inaccurate solution. – Jordon Bedwell Feb 18 '14 at 2:31
If your looking at a long file operation (like a database backup) this may a good simple alternative. – jcalfee314 Feb 18 '14 at 14:21
+1 I didn't know about watch – Matt Harrison Jun 18 '14 at 7:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .