25

I am aware of using lsof for checking the files currently accessed by a process. Does there exist a way to see all files that an application opens in its lifetime?

Dennis Williamson
  • 60,515
  • 14
  • 113
  • 148
Peter Smit
  • 1,649
  • 4
  • 21
  • 37
  • 1
    [Continuously monitor files opened/accessed by a process](https://superuser.com/q/348738/241386) – phuclv May 22 '17 at 03:37

2 Answers2

27

Using the strace command it migh be possible with something like :

strace -e trace=open program [arguments]
slubman
  • 2,247
  • 16
  • 11
  • This will show all files that a process _tried_ to access. One might think that something like `strace -e trace=open program [arguments] | grep -v ' = -1 ENOENT'` could improve the situation, but it's not true either. The latter will fail to detect unfinished and then resumed calls to `open`. – facetus Jan 19 '16 at 00:20
  • 3
    Note that the signal you need might be `openat`. – merlinND Mar 05 '19 at 13:20
9

I'm not sure I have understood exactly what you want to do with this. But, have you considered strace ? It displays all system calls including files.

EDIT : Don't forget the -f option that allows you to follow forked processes.

Antoine Benkemoun
  • 7,314
  • 3
  • 41
  • 60