Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

lsof -p 12345 will list all the files opened by process whose pid is 12345 but only for a particular instant of time.

How can we continuously monitor a process from the start to end(until process is terminated) to list/show every single file accessed by the process during its whole lifetime?

share|improve this question

3 Answers 3

up vote 16 down vote accepted

Try with strace -p 12345; it should do what you are trying to achieve.

share|improve this answer
    
output is not friendly and too much extra things. –  MA1 Oct 21 '11 at 7:39
    
You can fix that by piping - strace -p {pid} | grep -i "Open" | tee files_opened.log. The key is grep, which lets you filter the output for the system call you want (e.g. open()). –  user26996 Mar 8 '12 at 10:26
9  
@Ninefingers Actually strace can do that better than grep with the -e option: strace -e open –  Dan D. Mar 8 '12 at 10:48
    
@DanD oh yeah, ofc :) –  user26996 Mar 8 '12 at 10:51
    
When I kill the strace command, it also kills the thing it is tracing. Why is this happening (cygwin)? –  CMCDragonkai May 1 at 5:52

This will loop re-running your command and clearing the screen each time:

watch "lsof -p 12345"

WARNING: this will miss quick file accesses and is only suitable to see long standing files

share|improve this answer
2  
This is somewhat clumsy compared to the other answer using strace. –  David Foerster Dec 5 '13 at 17:32
1  
That's inaccurate solution - a process may use files in between executions of lsof –  Dor Jan 31 '14 at 8:47
    
@Dor you can set the timing of lsof to sub 1 second and increase it's precision. While it's clumsy compared to others, you are wrong in that it's an inaccurate solution. –  Jordon Bedwell Feb 18 '14 at 2:31
    
If your looking at a long file operation (like a database backup) this may a good simple alternative. –  jcalfee314 Feb 18 '14 at 14:21
    
+1 I didn't know about watch –  Matt Harrison Jun 18 '14 at 7:43

The new utility fatrace will do this: https://launchpad.net/fatrace/

sudo fatrace | grep '(6514)'

Don't use the -p option, it means the opposite of what it means in lsof or other utilities.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.