shell - How to get files modified by certain process in Linux -


need find out files getting modified process.

tried lsof -p processid gives files opened process. want command or set of commands files opened , modified process.

if process not running, can use strace print system calls

strace -o logfile  <program> 

after this, write script open() , write() system calls, , able print lists of files written too.

if process running, have use combination of several things

  • lsof -p or /proc/<processid>/fd/*
  • last modified time stamp of files found in above
  • output of strace -p <processid> write() , open()

hope helps


Comments

Popular posts from this blog

image - ClassNotFoundException when add a prebuilt apk into system.img in android -

I need to import mysql 5.1 to 5.5? -

Java, Hibernate, MySQL - store UTC date-time -