Take the 2-minute tour ×

I know how to strace a certain program to see all the files it reads. I know how to see what processes are using a certain file at the moment.

But is there a way to log all file opens. I want something like tail -f some/log/file but instead lsof -f /file/someone/might/open/soon which prints out info every time something opens that file.


share|improve this question
add comment

2 Answers

This can be done with an Auditing System. You didn't specify your OS, I assume Linux. Check http://linux.die.net/man/8/auditd and the See also pages at the bottom.

share|improve this answer
add comment

You could use inotify to run lsof when the file is accessed. For example, in the incrontab:

/etc/passwd IN_ACCESS /tmp/lsof.sh $@

Incrontab doesn't seem to use the shell, so redirects can't be used. A wrapper can be used instead:

lsof -f -- $1 >> /tmp/lsof.log
share|improve this answer
add comment

Your Answer


