fatrace - Online in the Cloud

PROGRAM:

NAME

fatrace - report system wide file access events

SYNOPSIS

fatrace [ OPTIONS ]

DESCRIPTION

fatrace reports file access events from all running processes.

It does not report file access by fatrace itself, to avoid logging events caused by
writing the output into a file. It also ignores events on virtual and kernel file systems
such as sysfs, proc, and devtmpfs.

Its main purpose is to find processes which keep waking up the disk unnecessarily and thus
prevent some power saving.

By default, events are reported to stdout. This will cause some loops if you run this tool
in e. g. gnome-terminal, as this causes a disk access for every output line. To avoid
this, redirect the output into a file.

OUTPUT FORMAT

A typical event looks like

rsyslogd(875): W /var/log/auth.log
compiz(1971): O device 8:2 inode 658203

The line has the following fields:

· Process name. This is read from /proc/pid/comm, and might be abbreviated for long
process names.

· Process ID

· Event type: Open, Read, Write, or Close. Combinations are possible, such as CW for
closing a written file.

· Affected file. In some cases the path and name cannot be determined, e. g. because it
is a temporary file which is already deleted. In that case, it prints the devices' major
and minor number and the inode number. To examine such a process in more detail, you
should consider using strace(1).

If you specify the --timestamp option, the first field will be the current time.

OPTIONS

-c, --current-mount
Only record events on partition/mount of current directory. Without this option,
all (real) partitions/mount points are being watched.

-o FILE, --output=FILE
Write events to given file instead of standard output.

-s SECONDS, --seconds=SECONDS
Stop after the given number of seconds.

-t, --timestamp
Add timestamp to events. When this option is given once, the format will be a human
readable hour:minute:second.microsecond; when given twice, the timestamp is printed
as seconds/microseconds since the epoch.

-p PID, --ignore-pid=PID
Ignore events for this process ID. Can be specified multiple times.

-f TYPES, --filter=TYPES
Show only the given event types. TYPES is a list of C, R, O, or W with the above
meanings.

E. g. use --filter=OC to only show open and close events.

-C COMMAND, --command=COMMAND
Show only events for this command.

-h , --help
Print help and exit.

Use fatrace online using onworks.net services