Is there a way in the linux to find files which were accessed (read, write, doesn't matter) during computer boot and work? Or even better files that were NOT accessed at all during some time? I know there is a find / -atime +60 (for example for older than 60 days files) command, but problem is that in this system the modification of atime attribute for files is disabled as it works from flashcard. So i need some other way to find those files.

migrated from stackoverflow.com Dec 16 '10 at 12:53

This question came from our site for professional and enthusiast programmers.

  • 4
    Consider accepting correct answers to your questions. Also, upvote useful answers. – Alberto Zaccagni Dec 15 '10 at 17:03
  • Sure i will. I can't upvote answers yet, system doesn't allow it for me. – lugger1 Dec 15 '10 at 19:19

For files accessed during boot, I'd start with ureadahead:

$ sudo ureadahead --dump | grep /

which dumps the content of /var/lib/ureadahead/pack where the profiled boot file accesses are stored.

Otherwise there are lots of ways to monitor file access:

bootchart might be helpful to visualize what's happening during boot.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.