3

I know how to strace a certain program to see all the files it reads. I know how to see what processes are using a certain file at the moment.

But is there a way to log all file opens. I want something like tail -f some/log/file but instead lsof -f /file/someone/might/open/soon which prints out info every time something opens that file.

Thanks

quanta
  • 50,327
  • 19
  • 152
  • 213
lard farnwell
  • 31
  • 2

2 Answers2

2

This can be done with an Auditing System. You didn't specify your OS, I assume Linux. Check http://linux.die.net/man/8/auditd and the See also pages at the bottom.

ott--
  • 1,081
  • 1
  • 11
  • 13
1

You could use inotify to run lsof when the file is accessed. For example, in the incrontab:

/etc/passwd IN_ACCESS /tmp/lsof.sh $@

Incrontab doesn't seem to use the shell, so redirects can't be used. A wrapper can be used instead:

lsof -f -- $1 >> /tmp/lsof.log
Cakemox
  • 24,141
  • 6
  • 41
  • 67