up vote 0 down vote favorite
share [g+] share [fb]

lsof -p 12345 will list all the files opened by process whose pid is 12345 but only for a particular instant of time.

How can we continuously monitor a process from the start to end(until process is terminated) to list/show every single file accessed by the process during its whole lifetime?

link|improve this question
77% accept rate
feedback

1 Answer

up vote 2 down vote

Try with strace -p 12345; it should do what you are trying to achieve.

link|improve this answer
output is not friendly and too much extra things. – MA1 Oct 21 '11 at 7:39
You can fix that by piping - strace -p {pid} | grep -i "Open" | tee files_opened.log. The key is grep, which lets you filter the output for the system call you want (e.g. open()). – Ninefingers Mar 8 at 10:26
1  
@Ninefingers Actually strace can do that better than grep with the -e option: strace -e open – Dan D. Mar 8 at 10:48
@DanD oh yeah, ofc :) – Ninefingers Mar 8 at 10:51
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.