Re: see what files are touched by a program

[vogelke+debian@pobox.com (Karl Vogel)]

>> On Sun, 17 Oct 2010 21:57:36 +0200, 
>> Steven <redalert.commander@gmail.com> said:

S> Can anyone point me to a program that will let me know what files a
S> certain application touches? More importantly, writes to.  Something
S> like "filestouched vi filename" which would then report 'filename' as
S> being used.

   "strace" will do what you want, but it's awkward to use if this app is
   being called by something else.  The easiest way might be to use a
   small script as a placeholder for the application:

     you% mv /path/to/app /path/to/app.bin

     you% cat /path/to/app
     #!/bin/sh
     strace -e trace=open -o /tmp/x$$ /path/to/app.bin ${1+"$@"}
     grep -v RDONLY /tmp/x$$ > /tmp/app$$
     exec rm /tmp/x$$
     exit 1

   Running this using "vim" for the command and "stuff" for the filename
   gave me this trace in /tmp/app21656:

     open("/tmp/stuff.swp", O_RDWR|O_CREAT|O_EXCL|O_LARGEFILE, 0600) = 4
     open("4913", O_WRONLY|O_CREAT|O_EXCL|O_LARGEFILE, 0100644) = 3
     open("stuff", O_WRONLY|O_CREAT|O_TRUNC|O_LARGEFILE, 0644) = 3
     open("/me/.viminfo.tmp", O_WRONLY|O_CREAT|O_EXCL|O_LARGEFILE, 0600) = 5

-- 
Karl Vogel                      I don't speak for the USAF or my company
He'd make a lovely corpse.                      --Charles Dickens