Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

In a Linux System, I would like to get a list of all the files that are being opened(read or write) by a specific process in his lifetime. His lifetime could be several hours, from start to finish.

I do not want to debug the kernel.

I don't mind using a simulation program like http://valgrind.org/

I tried using lsof, however I am not sure if all the files are listed that were ever opened.

share|improve this question

3 Answers 3

up vote 1 down vote accepted

You can use strace:

strace -e open command

Example:

$ strace -e open who
open("/etc/ld.so.cache", O_RDONLY)      = 3
open("/lib/libc.so.6", O_RDONLY)        = 3
open("/usr/lib/locale/locale-archive", O_RDONLY) = 3
open("/var/run/utmp", O_RDONLY|O_CLOEXEC) = 3
open("/usr/lib/gconv/gconv-modules.cache", O_RDONLY) = 3
open("/etc/localtime", O_RDONLY)        = 3
cyrus    console      2011-12-08 15:34 (:0)
cyrus    :0           2011-12-08 15:34
share|improve this answer

1 tidbit of advise... read the man-page. specifically look at the "-p" parameter for lsof.

    -p s     This option excludes or selects the listing of  files  for  the
             processes

the "s" is the process ID for whatever process you're talking about. You can snag that from doing a simple

ps ax |grep yourprocessname

and snagging that first number. then simply do a

lsof -p your-snagged-number

and voila. All files in-use by a process.

and no, it only includes the files that are currently open. strace might be a better option... but much more complex.

share|improve this answer
    
Missing a file that could have been opened at some point is a no-go. So lsof is out of the question in that case. Pooling the result of lsof is an option, but still, not a good one –  Zlatko Dec 9 '11 at 9:36

You can use strace for the task, if it's installed in your system:

strace -o strace.log <Your command>

In the resulting log file, you can grep for "open(" to find any files that were opened. You can also grep for other things that might interest you, such as file reads/writes, network access, and other activity.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.