62

I know I can view the open files of a process using lsof at that moment in time on my Linux machine. However, a process can open, alter and close a file so quickly that I won't be able to see it when monitoring it using standard shell scripting (e.g. watch) as explained in "monitor open process files on linux (real-time)".

So, I think I'm looking for a simple way of auditing a process and see what it has done over the time passed. It would be great if it's also possible to see what network connections it (tried to) make and to have the audit start before the process got time to run without the audit being started.

Ideally, I would like to do this:

sh $ audit-lsof /path/to/executable
4530.848254 OPEN  read  /etc/myconfig
4530.848260 OPEN  write /var/log/mylog.log
4540.345986 OPEN  read  /home/gert/.ssh/id_rsa          <-- suspicious
4540.650345 OPEN  socket TCP ::1:34895 -> 1.2.3.4:80    |
[...]
4541.023485 CLOSE       /home/gert/.ssh/id_rsa          <-- would have missed
4541.023485 CLOSE socket TCP ::1:34895 -> 1.2.3.4:80    |   this when polling

Would this be possible using strace and some flags to not see every system call?

Community
  • 1
gertvdijk
  • 13,459
  • 7
  • 45
  • 59
  • [Continuously monitor files opened/accessed by a process](https://superuser.com/q/348738/241386) – phuclv May 22 '17 at 03:36

1 Answers1

81

Running it with

strace -e trace=open,openat,close,read,write,connect,accept your-command-here

would probably be sufficient.

You'll need to use the -o option to put strace's output somewhere other than the console, if the process can print to stderr. If your process forks, you'll also need -f or -ff.

Oh, and you might want -t as well, so you can see when the calls happened.

Note, you may need to tweak the function call list depending on what your process does - I needed to add getdents for example, to get better sample using ls:

$ strace -t -e trace=open,openat,close,read,getdents,write,connect,accept ls >/dev/null
...
09:34:48 open("/etc/ld.so.cache", O_RDONLY) = 3
09:34:48 close(3)                       = 0
09:34:48 open("/lib64/libselinux.so.1", O_RDONLY) = 3
09:34:48 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@V\0\0\0\0\0\0"..., 832) = 832
09:34:48 close(3)                       = 0
...
09:34:48 open("/proc/filesystems", O_RDONLY) = 3
09:34:48 read(3, "nodev\tsysfs\nnodev\trootfs\nnodev\tb"..., 1024) = 366
09:34:48 read(3, "", 1024)              = 0
09:34:48 close(3)                       = 0
09:34:48 open("/usr/lib/locale/locale-archive", O_RDONLY) = 3
09:34:48 close(3)                       = 0
09:34:48 open(".", O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC) = 3
09:34:48 getdents(3, /* 5 entries */, 32768) = 144
09:34:48 getdents(3, /* 0 entries */, 32768) = 0
09:34:48 close(3)                       = 0
09:34:48 write(1, "file-A\nfile-B\nfile-C\n", 21) = 21
09:34:48 close(1)                       = 0
09:34:48 close(2)                       = 0
theY4Kman
  • 178
  • 1
  • 5
Useless
  • 4,700
  • 21
  • 20
  • 2
    That's getting into the right direction, thanks! Would like a more user friendly output, but it does the job. I might take the time to write a tool with a more top-like interface for this. I was hoping an ncurses-based or 'top'-like tool would exist to inspect the binary's actions real-time. – gertvdijk Dec 19 '12 at 14:43
  • How would you like it to look? It's probably possible to munge the strace output into something friendlier. – Useless Dec 19 '12 at 14:44
  • you definitely want to use `-o` to push the output to file(s). Then you can run `tail -F strace.output` in another terminal to get "live" update. – peterph Dec 19 '12 at 14:50
  • 7
    You can also attach `strace` to a running process with the `-p PID` option. – Frank Breitling Mar 18 '17 at 18:44
  • 4
    Add `-y` to "[p]rint paths associated with file descriptor arguments" – ricab Aug 23 '19 at 09:47
  • 8
    Don't forget **`openat`** and such! – user541686 Mar 24 '20 at 20:16
  • If you want to see the paths of files opened, instead of just file numbers, see: https://serverfault.com/a/727647/104579 – Flimm Aug 24 '22 at 13:59