opensnoop-nd(8)

NAME
opensnoop-nd - trace process open() with arguments. Uses Linux SystemTap (non-debuginfo).

SYNOPSIS
opensnoop-nd.stp

DESCRIPTION
This traces the open() syscall system-wide, to show which files are being opened, and by who. This is a basic version of opensnoop.

REQUIREMENTS
SystemTap.

EXAMPLES

Trace all open() syscalls, showing process and file details:
    # opensnoop-nd.stp

FIELDS

UID User ID.

PID Process ID.

PPID
    Parent process ID.

COMM
    Process name.

FD  Return value of the open() syscall, which is either the resulting file descriptor (positive) or error code (negative).

PATH
    File pathname provided to the open() syscall.

OVERHEAD
This reads and processes open() events and prints a line of output for each. If your applications perform a high rate of open()s, the overhead of this tool may become noticeable.

SOURCE
This is from the SystemTap lwtools collection.

    https://github.com/brendangregg/systemtap-lwtools

Also look under the examples directory for a text file containing example usage, output, and commentary for this tool.

OS
Linux

STABILITY
Unstable - in development.

AUTHOR
Brendan Gregg

SEE ALSO
strace(1)