Show HN: Watch what files any Linux process accesses

Not taking anything away from the worth of this tool but if you do happen to find yourself needing to quickly inspect which files a process has open you can do so using the &#x2F;proc file system:<p><pre><code> ls -l &#x2F;proc&#x2F;$PID&#x2F;fd&#x2F; </code></pre> Additionally you can also use the &#x2F;proc file system to display where the cursor is in those files by outputting the contents of<p><pre><code> &#x2F;proc&#x2F;$PID&#x2F;fdinfo&#x2F;$FD </code></pre> which is handy if you have a long running process but forgot to pipe it into `pv` (or any other long running ingest that lacks a progress UI)<p>(Both tricks are Linux only)

biotop and biolatency surface similar info. they come with a ton of other ridiculously awesome tools in BCC tools. they are a set of python wrapper scripts that run eBPF programs. using eBPF generally has a really low impact on performance when compared with other tools that do similar work.<p><a href="https:&#x2F;&#x2F;github.com&#x2F;iovisor&#x2F;bcc" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;iovisor&#x2F;bcc</a>

How is this different from using something like,<p>`strace -e trace=file`<p>I see that you are using ptrace to monitor a process. That is also used by strace. Is there something else your application does that strace does not (In relation to files)?

For macOS, fs_usage does the same job. I find it invaluable to find out what process is churning the disk (usually mds...).

Just a heads up (<i>read: shameless plug</i>), there&#x27;s an AUR package:<p><a href="https:&#x2F;&#x2F;aur.archlinux.org&#x2F;packages&#x2F;whatfiles-git&#x2F;" rel="nofollow">https:&#x2F;&#x2F;aur.archlinux.org&#x2F;packages&#x2F;whatfiles-git&#x2F;</a>

For doing the opposite - what processes access a given file - I like to use Audit (<a href="https:&#x2F;&#x2F;wiki.archlinux.org&#x2F;index.php&#x2F;Audit_framework#Audit_files_and_directories_access" rel="nofollow">https:&#x2F;&#x2F;wiki.archlinux.org&#x2F;index.php&#x2F;Audit_framework#Audit_f...</a>).

This looks very similar to <i>fatrace</i>, which is already in the standard ubuntu and fedora repos.<p><i>edit: fatrace is system-wide, whereas the current tools monitors a specific process</i><p><a href="http:&#x2F;&#x2F;manpages.ubuntu.com&#x2F;manpages&#x2F;trusty&#x2F;man1&#x2F;fatrace.1.html" rel="nofollow">http:&#x2F;&#x2F;manpages.ubuntu.com&#x2F;manpages&#x2F;trusty&#x2F;man1&#x2F;fatrace.1.ht...</a><p><a href="https:&#x2F;&#x2F;piware.de&#x2F;2012&#x2F;02&#x2F;fatrace-report-system-wide-file-access-events&#x2F;" rel="nofollow">https:&#x2F;&#x2F;piware.de&#x2F;2012&#x2F;02&#x2F;fatrace-report-system-wide-file-ac...</a>

Lots more such tools at <a href="https:&#x2F;&#x2F;jvns.ca&#x2F;debugging-zine.pdf" rel="nofollow">https:&#x2F;&#x2F;jvns.ca&#x2F;debugging-zine.pdf</a> (opensnoop-bpfcc and strace would be the most like this one)

BTW, if you are using strace for this, check out the -y option recently added to strace. It will print the filename next to each file descriptor like this:<p><pre><code> read(3&lt;&#x2F;proc&#x2F;filesystems&gt;, &quot;&quot;, 1024) = 0 </code></pre> Another interesting new strace option is -k which does a stack dump after each syscall. this can be useful to find out what part of the application, like some obscure lib, does weird system calls in your app.

IMO ProcMon on Windows is its equivalent. Not Process Explorer.

Any reason why this is better than audit? I read README but i’m still not clear.

Can it be invoked recursively?<p>Because strace on Linux still fails with:<p><pre><code> strace: ptrace(PTRACE_TRACEME, ...): Operation not permitted </code></pre> in those cases :(