Continuously monitor files opened/accessed by a process

Question

lsof -p 12345 will list all the files opened by process whose pid is 12345 but only for a particular instant of time.

How can we continuously monitor a process from the start to end(until process is terminated) to list/show every single file accessed by the process during its whole lifetime?

Solution 1

Try with strace -p 12345; it should do what you are trying to achieve.

The output can be filtered to only display opened files (Dan D.'s comment):

strace -e open -p 12345

Note: you can also trace quickly running processes with strace -e open <command>.

Solution 2

The new utility fatrace will do this: https://launchpad.net/fatrace/

sudo fatrace | grep '(6514)'

Don't use the -p option, it means the opposite of what it means in lsof or other utilities.

Solution 3

This will loop re-running your command and clearing the screen each time:

watch "lsof -p 12345"

WARNING: this will miss quick file accesses and is only suitable to see long standing files

Comments

[phuclv]

How do I monitor opened files of a process in realtime?

[MA1]

output is not friendly and too much extra things.

[Dan D.]

@Ninefingers Actually strace can do that better than grep with the -e option: strace -e open

[andyB]

@DanD oh yeah, ofc :)

[David Foerster]

This is somewhat clumsy compared to the other answer using strace.

[Dor]

That's inaccurate solution - a process may use files in between executions of lsof

[Jordon Bedwell]

@Dor you can set the timing of lsof to sub 1 second and increase it's precision. While it's clumsy compared to others, you are wrong in that it's an inaccurate solution.

[jcalfee314]

If your looking at a long file operation (like a database backup) this may a good simple alternative.

[CMCDragonkai]

When I kill the strace command, it also kills the thing it is tracing. Why is this happening (cygwin)?

[Jens Erat]

Sounds like a bug. Be aware that the cygwin-strace is probably not the Linux-strace, as strace is a Linux-specific tool. Cygwin builds a Unix-compatiblity layer, and does not try to be Linux. With cygwin, you're probably better off using the original Windows tools.