lsof -p 12345 will list all the files opened by process whose pid is 12345 but only for a particular instant of time.

How can we continuously monitor a process from the start to end(until process is terminated) to list/show every single file accessed by the process during its whole lifetime?

up vote 27 down vote accepted

Try with strace -p 12345; it should do what you are trying to achieve.

The output can be filtered to only display opened files (Dan D.'s comment):

strace -e open -p 12345

Note: you can also trace quickly running processes with strace -e open <command>.

  • output is not friendly and too much extra things. – MA1 Oct 21 '11 at 7:39
  • You can fix that by piping - strace -p {pid} | grep -i "Open" | tee files_opened.log. The key is grep, which lets you filter the output for the system call you want (e.g. open()). – user26996 Mar 8 '12 at 10:26
  • 11
    @Ninefingers Actually strace can do that better than grep with the -e option: strace -e open – Dan D. Mar 8 '12 at 10:48
  • @DanD oh yeah, ofc :) – user26996 Mar 8 '12 at 10:51
  • When I kill the strace command, it also kills the thing it is tracing. Why is this happening (cygwin)? – CMCDragonkai May 1 '15 at 5:52

The new utility fatrace will do this: https://launchpad.net/fatrace/

sudo fatrace | grep '(6514)'

Don't use the -p option, it means the opposite of what it means in lsof or other utilities.

This will loop re-running your command and clearing the screen each time:

watch "lsof -p 12345"

WARNING: this will miss quick file accesses and is only suitable to see long standing files

  • 2
    This is somewhat clumsy compared to the other answer using strace. – David Foerster Dec 5 '13 at 17:32
  • 1
    That's inaccurate solution - a process may use files in between executions of lsof – Dor Jan 31 '14 at 8:47
  • @Dor you can set the timing of lsof to sub 1 second and increase it's precision. While it's clumsy compared to others, you are wrong in that it's an inaccurate solution. – Jordon Bedwell Feb 18 '14 at 2:31
  • If your looking at a long file operation (like a database backup) this may a good simple alternative. – jcalfee314 Feb 18 '14 at 14:21

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.