如何在Linux中跟踪每个文件的IO操作？ [英] How to trace per-file IO operations in Linux?

问题描述

我需要跟踪特定文件的 read 系统调用，目前我正在通过解析 strace 。由于 read 在文件描述符上运行，我必须跟踪 fd 和之间的当前映射。路径。此外，还必须监视 seek 以保持跟踪中当前位置为最新。

是有没有更好的方法来获得每个应用程序，每个文件路径IO跟踪在Linux？

解决方案

首先，你可能不会因为 fd 和路径之间的映射可以在 / proc / PID / fd / 。

其次，也许你应该使用LD_PRELOAD技巧并重载C open ， seek 和 read 系统调用。这里有一些文章 和 关于如何重载malloc / free。

我想这些系统调用应用相同的技巧并不会太差。它需要在C中实现，但是它应该比解析 strace 输出要少得多的代码和精确度。

I need to track read system calls for specific files, and I'm currently doing this by parsing the output of strace. Since read operates on file descriptors I have to keep track of the current mapping between fd and path. Additionally, seek has to be monitored to keep the current position up-to-date in the trace.

Is there a better way to get per-application, per-file-path IO traces in Linux?

解决方案

First, you probably don't need to keep track because mapping between fd and path is available in /proc/PID/fd/.

Second, maybe you should use the LD_PRELOAD trick and overload in C open, seek and read system call. There are some article here and there about how to overload malloc/free.

I guess it won't be too different to apply the same kind of trick for those system calls. It needs to be implemented in C, but it should take far less code and be more precise than parsing strace output.

这篇关于如何在Linux中跟踪每个文件的IO操作？的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！