4

I know that lsof can list all files which are being opened by running processes.

If there is a process, which will open a file and then will be terminated, I don't think I can catch the file that is opened by the process with lsof because the process terminated itself too fast.

So I'm looking for such a tool (named XXX), allowing me to do the thing as below:

XXX ./my_process args

And the output of the command should be like this:

file1
file2
file3

Which means that the my_process opens three files: file1, file2 and file3 while running.

Yves
  • 3,291

1 Answers1

4

You could use strace:

strace -e trace=open -o trace.log ./my_process args
Matthew Cline
  • 3,355
  • This can't detect files opened by subprocesses. – Black Mantha Jul 06 '22 at 11:06
  • 1
    I got 0 calls in the log, php turns out to use a different system call to open files, use trace=open,creat,openat,openat2,name_to_handle_at instead. (these are most of the system calls I could find which can open a file, I skipped the pcap ones) If it gives an error "invalid system call", remove that call from the list and try again. – Black Mantha Jul 06 '22 at 11:09