find amin to retrieve executed php files by apache

Question

So I have a massive legacy app that consists of half a million php files. For a single request, I would like to know which php files are used by apache to respond. I can look at the apache logs, they tell me what principal file is used but not the ones that are required later on.

I was trying find /path/to/app -amin +1 shortly after the request. This yielded no results. Files I cat /path/to/app/file.php do show up in the above find output (so the filesystem actually is mounted with the atime flag). Also, I assumed that apache somehow caches the files contents so I restarted it and requested a page. Also this didn't produce any results.

How can this be and/or is there another method I could use to find the accessed files?

Answer 1

Sorting by atime will most likely not give an expected output. If your filesystem if mounted with relatime, access times will not always be updated.

From the man page:

Update inode access times relative to modify or change time. Access time is only updated if the previous access time was earlier than the current modify or change time. (Similar to noatime, but doesn't break mutt or other applications that need to know if a file has been read since the last time it was modified.)

Using strictatime instead will update the atime every time.