Determine files modified by process

Question

I'm writing a program to be run from the Linux user space which spawns another process. How can it determine which files were modified by the spawned process after it completes?

Are you writing the spawned pgm or is it just some existing pgm over which you have no control and just using system() or the like? — Duck, Mar 12 '10 at 19:25

score 3 · Accepted Answer · edited May 23 '17 at 12:06

3

Call it under strace and parse the output you care about.

edited May 23 '17 at 12:06

Community

1
1

answered Mar 12 '10 at 19:27

Didn't know about this program - thanks for the hint! Shows a lot more than wrapping fopen() but still doesn't catch writes from g++. – dromodel Mar 12 '10 at 19:52
@balor: What are you doing with g++ that you don't know what files it writes? Normally it only modifies a single file and you can give the name on the command line. – Mar 12 '10 at 19:56

score 0 · Answer 2 · answered Mar 12 '10 at 19:11

0

Inject your own replacement for fopen(3) that records the names and modes.

answered Mar 12 '10 at 19:11

Ignacio Vazquez-Abrams

776,304
153
1,341
1,358

I think the proper jargon here is "library interposition". It's not a bad idea but doesn't seem to work for some reason on the program that I'm trying to monitor (g++). I'm only seeing accesses to files in /tmp. – dromodel Mar 12 '10 at 19:50

score 0 · Answer 3 · answered Mar 12 '10 at 21:25

0

Maybe g++ itself spawns other processes? Than "strace -fF -efile program" plus some filtering will probably help you.

answered Mar 12 '10 at 21:25

fungusakafungus

227
1
10

Determine files modified by process

3 Answers3