I need to track read
system calls for specific files, and I'm currently doing this by parsing the output of strace
. Since read
operates on file descriptors I have to keep track of the current mapping between fd
and path
. Additionally, seek
has to be monitored to keep the current position up-to-date in the trace.
Is there a better way to get per-application, per-file-path IO traces in Linux?
You could wait for the files to be opened so you can learn the fd and attach strace after the process launch like this:
strace -p pid -e trace=file -e read=fd