Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In a Linux System, I would like to get a list of all the files that are being opened(read or write) by a specific process in his lifetime. His lifetime could be several hours, from start to finish.

I do not want to debug the kernel.

I don't mind using a simulation program like

I tried using lsof, however I am not sure if all the files are listed that were ever opened.

share|improve this question
up vote 1 down vote accepted

You can use strace:

strace -e open command


$ strace -e open who
open("/etc/", O_RDONLY)      = 3
open("/lib/", O_RDONLY)        = 3
open("/usr/lib/locale/locale-archive", O_RDONLY) = 3
open("/var/run/utmp", O_RDONLY|O_CLOEXEC) = 3
open("/usr/lib/gconv/gconv-modules.cache", O_RDONLY) = 3
open("/etc/localtime", O_RDONLY)        = 3
cyrus    console      2011-12-08 15:34 (:0)
cyrus    :0           2011-12-08 15:34
share|improve this answer

1 tidbit of advise... read the man-page. specifically look at the "-p" parameter for lsof.

    -p s     This option excludes or selects the listing of  files  for  the

the "s" is the process ID for whatever process you're talking about. You can snag that from doing a simple

ps ax |grep yourprocessname

and snagging that first number. then simply do a

lsof -p your-snagged-number

and voila. All files in-use by a process.

and no, it only includes the files that are currently open. strace might be a better option... but much more complex.

share|improve this answer
Missing a file that could have been opened at some point is a no-go. So lsof is out of the question in that case. Pooling the result of lsof is an option, but still, not a good one – Zlatko Dec 9 '11 at 9:36

You can use strace for the task, if it's installed in your system:

strace -o strace.log <Your command>

In the resulting log file, you can grep for "open(" to find any files that were opened. You can also grep for other things that might interest you, such as file reads/writes, network access, and other activity.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .