Track all files accessed
Using strace
# -f => --follow-forks
# -t => --absolute-timestamps
# -e trace=file => filters only for syscalls that access the filesystem
# -o file => write trace to file rather than to stderror
strace -f -t -e trace=file -o stracelog <your command here>How can I determine what process has a file open in Linux?
use lsof or fuser
$ lsof /home/fin
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
bash 21310 fin cwd DIR 8,1 4096 5054467 /home/fin
lsof 21320 fin cwd DIR 8,1 4096 5054467 /home/fin
lsof 21321 fin cwd DIR 8,1 4096 5054467 /home/fin
Written on December 3, 2023, Last update on December 3, 2023
file
trace