Ubuntu – How to know which file a program is trying to access

filesprocess

I have a program which I am trying to run, however when I run it; it just complains that it can't find a particular file.

However I have no idea which folder it is trying to find this particular file in. I have a copy of the required file, I just need to know which folder to copy it too.

Is there any way to show in real time which files are being accessed or which files are trying and failing to be accessed?

I am using Ext4 filesystem if that helps.

Thanks

Best Answer

(I first posted my answer at this askubuntu question, but removed it from there and posted it here, as it is more relevant.)

There are several ways you can investigate what files and libraries processes have opened; the main tools are lsof, strace and ltrace. Sometimes it is necesary to run them with sudo, so the program has access to everything it needs to gain an accurate snapshot of what a program is calling.

1) With lsof you need to find the process id you want to query, so use, for example:

lsof -c firefox

which will list all the files firefox has open and all its calls to system shared libraries. (Firefox currently has a pid of 3310 on my system, so you could also use lsof -p 3310, but you would have had to look up the process id first with ps aux | grep [f]irefox ). More information on lsof is detailed in this useful IBM article.

2) ltrace and strace have very similar functions and options, and are very useful for finding out detailed information about what calls a process is making. The main difference is that ltrace usually only traces library calls (although it can trace system calls with the -S option), while strace traces both library and other system calls. More information on tracing processes is available in this IBM article. Lsof is probably more useful for you if you want to examine an already running process but strace can also do this and monitor the calls in real time when given a process pid (sudo is always used when one attaches to a process):

sudo strace -p 3310

but it is much more useful to launch the program with strace and see what was called, as in the following example:

strace -f -e trace=open /usr/bin/firefox

You can just run strace with the target process and no options, but the switches here mean that child processes are traced (-f) and that all open system calls are traced (-e trace=open) If you want to save the output to file you can specify -o ~/firefox.trace before specifying /usr/bin/firefox.

If you want a summary list of library calls, for example, you could use

ltrace -c /usr/bin/leafpad

and then exit the program and the list would be produced. Omit the -c option to view the calls in real time.

The results from strace and ltrace may not be greatly useful to you, as they are difficult to decipher unless you know what you are looking for, but lsof should provide some basic useful information.

Using `iwatch`

iwatch o_O is a realtime filesystem monitoring program using inotify and a working local mail service

For a better obscurity you should change the mail address and start the deamon as root, or something else … :)

sudo apt-get install iwatch

Create a configuration file with the name iwatch.xml

<?xml version="1.0" ?>
<!DOCTYPE config SYSTEM "/etc/iwatch/iwatch.dtd" >
<config>
        <guard email="username@localhost" name="iWatch"/>
        <watchlist>
                <title>a title</title>
                <contactpoint email="username@localhost" name="foo bar"/>
                <path type="recursive" events="default">/home/username</path>
        </watchlist>
</config>

Start the deamon
```
iwatch -d -f iwatch.xml -p ~/iwatch.pid
```
-d Execute the application as daemon. iWatch will run in foregroud without this option.

-f Specify alternative configuration file. Default is /etc/iwatch/iwatch.xml

-p Specify an alternate pid file. Default: /var/run/iwatch.pid
Check your local mails ;)

Some interesting events

-e event [,event[,..]]
   Specify a list of events you want to watch. Following are the possible events you
   can use:
access          : file was modified
modify          : file was modified
attrib          : file attributes changed
close_write     : file closed, after being opened in writeable mode
close_nowrite   : file closed, after being opened in read-only mode
close           : file closed, regardless of read/write mode
open            : file was opened
moved_from      : File was moved away from.
moved_to        : File was moved to.
move            : a file/dir within watched directory was moved
create          : a file was created within watched director
delete          : a file was deleted within watched directory
delete_self     : the watched file was deleted
unmount         : file system on which watched file exists was unmounted
q_overflow      : Event queued overflowed
ignored         : File was ignored
isdir           : event occurred against dir
oneshot         : only send event once
all_events      : All events
default         : close_write, create, delete, move, delete_self and move_self.

More information here

Ubuntu – How to find all empty files and folders in a specific directory including files which just look empty but are not

From man find

    -empty File is empty and is either a regular file or a directory.

So to find both empty files and directories it is sufficient to do

find ~/lists -empty

To indicate the type, you could use the %y output format specifier

          %y     File's type (like in ls -l), U=unknown type (shouldn't happen)

e.g.

find ~/lists -empty -printf '%y %p\n'

or make use of an external program like ls, which includes a --classify option

    -F, --classify
          append indicator (one of */=>@|) to entries

i.e.

find ~/lists -empty -exec ls -Fd {} \;

If your definition of 'empty' is expanded to include files containing only whitespace characters, then it becomes more complicated - and more computationally intensive, since now you need to actually open at least any non-empty files and examine their contents. The most efficient way I can think of off the top of my head would be something like

find ~/list \( -empty -o \( -type f -a ! -exec grep -qm1 '[^[:blank:]]' {} \; \) \) -exec ls -Fd {} \;

(either empty, OR a file AND grep does not detect at least one non-blank character). Likely there is a better way though.

Best Answer

Related Solutions

Ubuntu – How to log file access from users

Using iwatch

Ubuntu – How to find all empty files and folders in a specific directory including files which just look empty but are not

Related Question

Using `iwatch`