Robert Watson wrote: > A lot of people have answered and told you about lsof, which is a great tool, > and can give > you a momentary snapshot of the files a process has open. You might also be > interested in > getting a log of accesses, which you can do using ktrace(1). This tracks > system calls and > you can see what paths are being accessed at time of open. As of 7.x (and > hopefully 6.2 once > the MFC happens) you'll also be able to use audit(4) to track access of files > by processes.
Sadly, ktrace(1) seems to be rather useless in RELENG_6 right now. Every medium sized app will result in an "out of ktrace objects" error. I remember that some improvements to ktrace(1) went into -CURRENT. Time for an MFC? Ulrich Spoerlein -- PGP Key ID: 20FEE9DD Encrypted mail welcome! Fingerprint: AEC9 AF5E 01AC 4EE1 8F70 6CBD E76E 2227 20FE E9DD Which is worse: ignorance or apathy? Don't know. Don't care.
pgpqxY87H4unN.pgp
Description: PGP signature
