1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
|
Demonstrations of opensnoop, the Linux ftrace version.
# ./opensnoop
Tracing open()s. Ctrl-C to end.
COMM PID FD FILE
opensnoop 5334 0x3
<...> 5343 0x3 /etc/ld.so.cache
opensnoop 5342 0x3 /etc/ld.so.cache
<...> 5343 0x3 /lib/x86_64-linux-gnu/libc.so.6
opensnoop 5342 0x3 /lib/x86_64-linux-gnu/libm.so.6
opensnoop 5342 0x3 /lib/x86_64-linux-gnu/libc.so.6
<...> 5343 0x3 /usr/lib/locale/locale-archive
<...> 5343 0x3 trace_pipe
supervise 1684 0x9 supervise/status.new
supervise 1684 0x9 supervise/status.new
supervise 1688 0x9 supervise/status.new
supervise 1688 0x9 supervise/status.new
supervise 1686 0x9 supervise/status.new
supervise 1685 0x9 supervise/status.new
supervise 1685 0x9 supervise/status.new
supervise 1686 0x9 supervise/status.new
[...]
The first several lines show opensnoop catching itself initializing.
Use -h to print the USAGE message:
# ./opensnoop -h
USAGE: opensnoop [-htx] [-d secs] [-p PID] [-T TID] [-n name] [filename]
-d seconds # trace duration, and use buffers
-n name # process name to match on open
-p PID # PID to match on open
-L TID # thread id to match on open
-t # include time (seconds)
-x # only show failed opens
-h # this usage message
filename # match filename (partials, REs, ok)
eg,
opensnoop # watch open()s live (unbuffered)
opensnoop -d 1 # trace 1 sec (buffered)
opensnoop -p 181 # trace I/O issued by PID 181 only
opensnoop conf # trace filenames containing "conf"
opensnoop 'log$' # filenames ending in "log"
See the man page and example file for more info.
|
