28

lsof -p 12345 will list all the files opened by process whose pid is 12345 but only for a particular instant of time.

How can we continuously monitor a process from the start to end(until process is terminated) to list/show every single file accessed by the process during its whole lifetime?

Improve this question
1

3 Answers 3

Reset to default
34

Try with strace -p 12345; it should do what you are trying to achieve.

The output can be filtered to only display opened files (Dan D.'s comment):

strace -e open -p 12345

Note: you can also trace quickly running processes with strace -e open <command>.

Improve this answer
5
  • output is not friendly and too much extra things.
    – MA1
    Oct 21, 2011 at 7:39
  • You can fix that by piping - strace -p {pid} | grep -i "Open" | tee files_opened.log. The key is grep, which lets you filter the output for the system call you want (e.g. open()).
    – user26996
    Mar 8, 2012 at 10:26
  • 11
    @Ninefingers Actually strace can do that better than grep with the -e option: strace -e open
    – Dan D.
    Mar 8, 2012 at 10:48
  • When I kill the strace command, it also kills the thing it is tracing. Why is this happening (cygwin)?
    – CMCDragonkai
    May 1, 2015 at 5:52
  • Sounds like a bug. Be aware that the cygwin-strace is probably not the Linux-strace, as strace is a Linux-specific tool. Cygwin builds a Unix-compatiblity layer, and does not try to be Linux. With cygwin, you're probably better off using the original Windows tools.
    – Jens Erat
    May 1, 2015 at 8:36
8

The new utility fatrace will do this: https://launchpad.net/fatrace/

sudo fatrace | grep '(6514)'

Don't use the -p option, it means the opposite of what it means in lsof or other utilities.

Improve this answer
3

This will loop re-running your command and clearing the screen each time:

watch "lsof -p 12345"

WARNING: this will miss quick file accesses and is only suitable to see long standing files

Improve this answer
4
  • 2
    This is somewhat clumsy compared to the other answer using strace.
    – David Foerster
    Dec 5, 2013 at 17:32
  • 2
    That's inaccurate solution - a process may use files in between executions of lsof
    – Dor
    Jan 31, 2014 at 8:47
  • @Dor you can set the timing of lsof to sub 1 second and increase it's precision. While it's clumsy compared to others, you are wrong in that it's an inaccurate solution.
    – Jordon Bedwell
    Feb 18, 2014 at 2:31
  • If your looking at a long file operation (like a database backup) this may a good simple alternative.
    – jcalfee314
    Feb 18, 2014 at 14:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .