filegone [-h] [-p PID]
This traces why file gone/vanished, providing information on who deleted or renamed the file.
This works by tracing the kernel vfs_unlink() , vfs_rmdir() , vfs_rename functions.
Since this uses BPF, only the root user can use this tool.
CONFIG_BPF and bcc.
Print usage message.
- -p PID
Trace this process ID only (filtered in-kernel).
- Trace all file gone events
- Trace file gone events caused by PID 181:
# filegone -p 181
Time of the event.
Process ID that renamed/deleted the file.
Process name for the PID.
action on file: 'DELETE' or 'RENAME'
This traces the kernel VFS file rename and delete functions and prints output for each event. As the rate of this is generally expected to be low (< 1000/s), the overhead is also expected to be negligible. This is from bcc.
Also look in the bcc distribution for a companion _examples.txt file containing example usage, output, and commentary for this tool.
Unstable - in development.