| Demonstrations of filegone, the Linux eBPF/bcc version. |
| |
| |
| filegone traces why file gone, either been deleted or renamed |
| For example: |
| |
| # ./filegone |
| 18:30:56 22905 vim DELETE .fstab.swpx |
| 18:30:56 22905 vim DELETE .fstab.swp |
| 18:31:00 22905 vim DELETE .viminfo |
| 18:31:00 22905 vim RENAME .viminfo.tmp > .viminfo |
| 18:31:00 22905 vim DELETE .fstab.swp |
| |
| USAGE message: |
| |
| usage: filegone.py [-h] [-p PID] |
| |
| Trace why file gone (deleted or renamed) |
| |
| optional arguments: |
| -h, --help show this help message and exit |
| -p PID, --pid PID trace this PID only |
| |
| examples: |
| ./filegone # trace all file gone events |
| ./filegone -p 181 # only trace PID 181 |
