Linux – Trace access to a directory tree

inotifylinux

Situation

I have a directory /home/foo on a server, and I guess that it is not needed any more.

Unfortunately nobody can tell me if this directory is still needed.

Goal

If this directory is still needed, I want to know which process accesses it.

Current Strategy

Watch all file opens below this directory.

Why not inotify

Unfortunately the directory contains a lot of sub-directories, that's why I don't want to use inotify.

  • 1604508 files
  • 287253 sub-directories

Question

How can I watch all file opens below a directory (recursive) tree? I want to know which process access it.

Environment

  • /home is an ext4 filesystem.
  • SuSE Linux 12.3. Kernel: 3.7.10

Not duplicate

My question is not a duplicate of Is it possible to find out what program or script created a given file? since ….:

  • I can't use inotify since the directory tree contains too many sub directories.
  • I can't use loggedfs: I can't change the file system type of this directory.

Bounty

There are already two good answers. But I am curious, maybe there are other ways: Bounty of 50 🙂

Best Answer

You should be able to use auditd (although it depends on your Linux distribution having it available).

The auditctl command is used to configure auditing, and the man page should describe how to achieve what you need.

Something like,

auditctl -w /home/foo -p war -k foo-watch

You can then search the audit log later using,

ausearch -k foo-watch

An example of doing this on SUSE can be found here.

Related Question