Tool to monitor file read/write in unix

Question

Is there any tool/command available in unix to monitor read/writes in a particular file.

I also want to collect how much data is being read each time the file is accessed.

Answer 1

Short answer, none that I know of.

vmstat (run vmstat 1 to get an immediate idea of what it does; ^C to quit) can show you the complete system IO use (BI and BO columns, blocks in and blocks out, are probably most immediately useful). I find it very useful on mostly-quiet systems.

strace (run strace -o /tmp/ls ls /tmp; then look at /tmp/ls file to see what data it gives you) would let you follow the execution path of your program through all the write() calls, and add up the requested sizes for whichever file descriptor you are interested in. On the plus side, it could be scripted and would be specifically for that program for that file. On the downside, it would slow down execution of your program (perhaps it would run very slowly), and it would completely miss all disk IO that uses mmap(2) memory regions.

You could write a library that you would load with LD_PRELOAD environment variable to replace read(2) and write(2) with wrappers that perform your accounting and wind up calling the system calls (this is almost certainly not worth the hassle). It would also fail to see disk IO that uses mmap(2). You'd have to have an awful good reason to go this route.

You could write a FUSE backend to do your accounting. It'd be slow, and it would slow down every process using that filesystem. The FUSE code also exposes a lot of kernel internals that expect fast results to arbitrarily long (and glacially long, by kernel standards) delays due to userspace programs. Programs might cause memory pressure, swapping, and further disk traffic. FUSE is best deployed in environments with plentiful memory, non-realtime requirements, and low cost of failure.

Answer 2

THere is fam, http://en.wikipedia.org/wiki/File_alteration_monitor, but not sure if its available for your OS http://oss.sgi.com/projects/fam/

Also google inotify.

Answer 3

In linux there have been several APIs for monitoring file system activity previously (dnotify and inotify), but the latest one is called fanotify. LWN discuss the API here.

For monitoring whole file systems there is iostat, what you ask for seems to be somewhat like iostat but only for a given file. I am not aware of such a combination, but by using the API you can write your own.

Answer 4

On Linux you can use incron. On Solaris/BSD you'll probably be able to get the information using DTrace.