shell - How to get files modified by certain process in Linux -
need find out files getting modified process.
tried lsof -p processid
gives files opened process. want command or set of commands files opened , modified process.
if process not running, can use strace
print system calls
strace -o logfile <program>
after this, write script open()
, write()
system calls, , able print lists of files written too.
if process running, have use combination of several things
lsof -p
or/proc/<processid>/fd/*
- last modified time stamp of files found in above
- output of
strace -p <processid>
write()
,open()
hope helps
Comments
Post a Comment