Sign in to follow this  

Recently-accessed files and devices

This topic is 3587 days old which is more than the 365 day threshold we allow for new replies. Please post a new topic.

If you intended to correct an error in the post then please contact us.

Recommended Posts

Hi. I want to get a list of whatever processes recently accessed a given file (by name or descriptor) or block device. Where is this information logged? Do I have to enable a certain type of logging?

Share this post


Link to post
Share on other sites
Quote:
Original post by spraff
Hi. I want to get a list of whatever processes recently accessed a given file (by name or descriptor) or block device. Where is this information logged? Do I have to enable a certain type of logging?

There's no way to get a list of processes that recently accessed a filesystem object or a device because that's done by the kernel, not a process. There may be a way to get the kernel to report what process made what system call, but that's not necessarily useful information since processes come and go rapidly and you're going to have difficulty mapping pid to programs after the process is gone.

What you can do quite effectively on Linux at least is to watch an inode for various transitions and try to capture which process is acessing the file at that point. Use the inotify calls to watch the inode. You are still liable to race conditions so your information is not guaranteed to be completely accurate, but at least you'll be able to get a good idea of file activity.

Share this post


Link to post
Share on other sites
Quote:
Original post by spraff
Hi. I want to get a list of whatever processes recently accessed a given file (by name or descriptor) or block device. Where is this information logged? Do I have to enable a certain type of logging?


For what purpose do you need to do this?

Share this post


Link to post
Share on other sites
Sign in to follow this