1

Is it possible to monitor all write access to the filesystem of all process under linux?

I've some different mounted filesystems. A lot of them are tempfs.

I'm interested in all writes to the root filesystem except the tempfs, devtmpfs etc.

I'm looking for something that will output: <PID xy> write n Bytes to /targe/filepath .... What monitoring tool can list all this write syscalls? Can they be filtered by mount points?

powerpete
  • 211
  • 2
  • 8
  • you most likely won't be able to do this. To monitor IO to fs, you can use inotify but it will not indicate the amount of read write byte nor the PID, only the file that has been read/write. You can use lsof to list open file by any process with it's process ID but it's instantanious not monitored so you could miss some short file IO. finally you can attach strace to a program, but it's CPU intensive and I'm not sure a system coulc attached strace to all the process. `strace` is the most complete solution but it is the more complexe as well and probably can't be use system wide. – Kiwy Jun 20 '18 at 11:56
  • inotify would be nice, but limit reached by `inotifywait -mr /` – powerpete Jun 20 '18 at 12:02
  • @Kiwy why limit yourself to user-space tools? ;-) – Stephen Kitt Jun 20 '18 at 12:08
  • @StephenKitt I already told you I'm a POWER user I tend to stay in the userspace :D – Kiwy Jun 20 '18 at 12:13
  • *What monitoring tool can list all this write syscalls?* [Auditing.](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/security_guide/chap-system_auditing) – Andrew Henle Jun 20 '18 at 14:52
  • Please don't cross post: https://stackoverflow.com/questions/50946478 – Kusalananda Jun 21 '18 at 12:16

1 Answers1

3

There are a number of tools you can use in various scenarios depending on the exact information you’re looking for. Brendan Gregg has a nice summary:

Diagram of observability tools

For I/O to specific devices, blktrace might be appropriate, although it can be difficult to map its output to specific files.

A better tool for your case could be SystemTap; it’s definitely worth taking the time to learn how to use it. You’d have to trace all file opens and writes, and then post-process the output. That will still miss I/O from memory-mapped files; you’d be able to see that with blktrace but that would be post-pagecache so it wouldn’t catch every explicit write (there’s a discussion of that somewhere on this site but I can’t find it just now). See this answer for an example involving SystemTap (to trace opened files).

Stephen Kitt
  • 411,918
  • 54
  • 1,065
  • 1,164
  • 1
    `auditd` comes to mind here. – Stéphane Chazelas Jun 20 '18 at 12:19
  • It does indeed @Stéphane, but I’ve never used it... [The Red Hat documentation](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/security_guide/chap-system_auditing) seems like a nice introduction. – Stephen Kitt Jun 20 '18 at 15:33