Which files were open during a process

Question

In a Linux System, I would like to get a list of all the files that are being opened(read or write) by a specific process in his lifetime. His lifetime could be several hours, from start to finish.

I do not want to debug the kernel.

I don't mind using a simulation program like http://valgrind.org/

I tried using lsof, however I am not sure if all the files are listed that were ever opened.

Answer 1

You can use strace:

strace -e open command

Example:

$ strace -e open who
open("/etc/ld.so.cache", O_RDONLY)      = 3
open("/lib/libc.so.6", O_RDONLY)        = 3
open("/usr/lib/locale/locale-archive", O_RDONLY) = 3
open("/var/run/utmp", O_RDONLY|O_CLOEXEC) = 3
open("/usr/lib/gconv/gconv-modules.cache", O_RDONLY) = 3
open("/etc/localtime", O_RDONLY)        = 3
cyrus    console      2011-12-08 15:34 (:0)
cyrus    :0           2011-12-08 15:34

Answer 2

1 tidbit of advise... read the man-page. specifically look at the "-p" parameter for lsof.

    -p s     This option excludes or selects the listing of  files  for  the
             processes

the "s" is the process ID for whatever process you're talking about. You can snag that from doing a simple

ps ax |grep yourprocessname

and snagging that first number. then simply do a

lsof -p your-snagged-number

and voila. All files in-use by a process.

and no, it only includes the files that are currently open. strace might be a better option... but much more complex.

Answer 3

You can use strace for the task, if it's installed in your system:

strace -o strace.log <Your command>

In the resulting log file, you can grep for "open(" to find any files that were opened. You can also grep for other things that might interest you, such as file reads/writes, network access, and other activity.