Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

lsof -p 12345 will list all the files opened by process whose pid is 12345 but only for a particular instant of time.

How can we continuously monitor a process from the start to end(until process is terminated) to list/show every single file accessed by the process during its whole lifetime?

share|improve this question

2 Answers 2

up vote 14 down vote accepted

Try with strace -p 12345; it should do what you are trying to achieve.

share|improve this answer
    
output is not friendly and too much extra things. –  MA1 Oct 21 '11 at 7:39
    
You can fix that by piping - strace -p {pid} | grep -i "Open" | tee files_opened.log. The key is grep, which lets you filter the output for the system call you want (e.g. open()). –  Ninefingers Mar 8 '12 at 10:26
9  
@Ninefingers Actually strace can do that better than grep with the -e option: strace -e open –  Dan D. Mar 8 '12 at 10:48
    
@DanD oh yeah, ofc :) –  Ninefingers Mar 8 '12 at 10:51

This will loop re-running your command and clearing the screen each time:

watch "lsof -p 12345"

WARNING: this will miss quick file accesses and is only suitable to see long standing files

share|improve this answer
2  
This is somewhat clumsy compared to the other answer using strace. –  David Foerster Dec 5 '13 at 17:32
    
That's inaccurate solution - a process may use files in between executions of lsof –  Dor Jan 31 at 8:47
    
@Dor you can set the timing of lsof to sub 1 second and increase it's precision. While it's clumsy compared to others, you are wrong in that it's an inaccurate solution. –  Jordon Bedwell Feb 18 at 2:31
    
If your looking at a long file operation (like a database backup) this may a good simple alternative. –  jcalfee314 Feb 18 at 14:21
    
+1 I didn't know about watch –  Matt Harrison Jun 18 at 7:43

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.