Is there a way in the linux to find files which were accessed (read, write, doesn't matter) during computer boot and work? Or even better files that were NOT accessed at all during some time? I know there is a find / -atime +60 (for example for older than 60 days files) command, but problem is that in this system the modification of atime attribute for files is disabled as it works from flashcard. So i need some other way to find those files.
-
4Consider accepting correct answers to your questions. Also, upvote useful answers.– Alberto ZaccagniCommented Dec 15, 2010 at 17:03
-
Sure i will. I can't upvote answers yet, system doesn't allow it for me.– lugger1Commented Dec 15, 2010 at 19:19
Add a comment
|
1 Answer
For files accessed during boot, I'd start with ureadahead:
$ sudo ureadahead --dump | grep /
which dumps the content of /var/lib/ureadahead/pack where the profiled boot file accesses are stored.
Otherwise there are lots of ways to monitor file access:
- inotify-tools, see monitoring file and directory access on linux
- loggedfs, but might be tricky to setup at boot time.
- fatrace, report system wide file access events.
- auditctl probably as well.
bootchart might be helpful to visualize what's happening during boot.
answered Oct 16, 2014 at 10:50
