Return to Answer

My favourite tool for monitoring which files an application opens is the powerful monitoring framework sysdig`.

Creating a trace file that will only contain writing events in home directories (which we can inspect later with "sysdig -r writetrace.scap.gz"):

Sysdig has many chisels, see for more interesting things it can do:

Sysdig Examples

How to monitor and troubleshoot a Linux server using sysdig

see also related answer Why are true and false so large?

My favorite tool for monitoring which files an application opens is the powerful monitoring framework sysdig.

Creating a trace file that will only contain writing events in home directories (which we can inspect later with sysdig -r writetrace.scap.gz):

Sysdig has many chisels, see for more interesting things it can do:

• Sysdig Examples

• How to monitor and troubleshoot a Linux server using sysdig

See also related answer Why are true and false so large?

sudo proc.name=exe_file sysdig -p "%12user.name %6proc.pid %12proc.name %3fd.num %fd.typechar %fd.name" evt.type=open

sudo sysdig -p "proc.name=exe_file %12user.name %6proc.pid %12proc.name %3fd.num %fd.typechar %fd.name" evt.type=open

My favourite tool for monitoring which files an application opens is still sysdig.

My favourite tool for monitoring which files an application opens is the powerful monitoring framework sysdig`.