permissions – View Temporary Files Existing for Milliseconds

data-recoveryfilespermissions

I'm trying to debug a program which is not logging the information I need. Fortunately, it does write temporary files which should contain the information. These files are written to a directory like: program/temp/{someGUID} on one of ten machines. Neither {someGUID} nor which machine will contain the temp files is known in advance of the run. After the run is complete, the temporary files are deleted. The time from beginning to end is too fast for manual intervention.

I kick off the runs through a client program, but it is the server which writes the files. I am unable to manipulate the server program and once a run is kicked off I am unable to stop it. I do have root access to the all the machines on which the temp files could be written. I'm running CentOS 6.

Is there a way to allow the server user to write files to the temp directory but not remove them? It would probably crash the run, but it would give me the information I need. Is there a way to copy the contents of the temp folder right after they are written/before they are deleted? Must I install a program for recovery of deleted files?

Best Answer

List the files accessed by a program mentions several ways to log the program's file accesses (strace, LD_PRELOAD, LoggedFS, audit), but no convenient way to grab the file contents.

A convenient way to save all the program's output is copyfs. CopyFS creates a view of a directory tree that retains all past versions of all files that ever existed in that directory tree. Note that it can be used without root access. Mount the directory containing the temporary files:

mkdir versions
copyfs-mount $PWD/versions $PWD/program/temp
program_to_debug
fusermount -u program/temp
ls versions
Related Question