filegone-bpfcc8
Trace why file gone (deleted or renamed). uses linux ebpf/bcc.
Usage
filegone [-h]
[-p
PID]
Overview
This traces why file gone/vanished, providing information on who deleted or renamed the file.
This works by tracing the kernel vfs_unlink() , vfs_rmdir() , vfs_rename functions.
Since this uses BPF, only the root user can use this tool.
Requirements
CONFIG_BPF and bcc.
Options
-
-h -
Print usage message.
-
-p PID -
Trace this process ID only (filtered in-kernel).
Examples
Trace all file gone events
|
# |
|---|---|
Trace file gone events caused by PID 181:
|
# filegone -p 181 |
Fields
TIME
|
Time of the event. |
|---|---|
PID
|
Process ID that renamed/deleted the file. |
COMM
|
Process name for the PID. |
ACTION
|
action on file: 'DELETE' or 'RENAME' |
FILE
|
Filename. |
Overhead
This traces the kernel VFS file rename and delete functions and prints output for each event. As the rate of this is generally expected to be low (< 1000/s), the overhead is also expected to be negligible. This is from bcc.
-
https://github.com/iovisor/bcc
Also look in the bcc distribution for a companion _examples.txt file containing example usage, output, and commentary for this tool.
OS
Linux
Stability
Unstable - in development.
Releases
Unchanged in 2 releases since Debian 12 (Bookworm).