views:

266

answers:

6

I found in IOStat, that some part of my application is writing extensively, but I don't know which process it is and what files it is writing to. In Vista there is a tool fo that which shows the files that have been active in the last 30 Seconds. Is there something similar for Linux?

+1  A: 

To find all files modified in the last 24 hours (last full day) in a particular specific directory and its sub-directories:

find /directory_path -mtime -1 -print

more at:

http://www.mydigitallife.info/2006/01/19/find-files-that-are-modified-today-or-since-certain-time-ago-in-unix/

Finer Recliner
And is there also some way to monitor the activity (read write kb/s) on individual files? The server is quite active and many files get changed, but I need those with the highest transfer...
smint
+1  A: 

Not sure of a program but the find command in utility has a lot of options which will allow you to find files and/or directories that have been modified within a certain time period.

For example:

$ find /home/you -iname "*.txt" -mtime -1 -print

Would find text files that were last modified 1 days ago.

You could wrap this call in some sort of script or write your own quick little app to use the results.

Here's a site with some more info and examples:

http://www.cyberciti.biz/faq/howto-finding-files-by-date/

cakeforcerberus
+2  A: 

What you are looking for is lsof. It's a command line tool but there is also a GUI for it at sourceforge.

Ludwig Weinzierl
lsof is only going to show you the files the process has open <em>now</em>
PiedPiper
+1  A: 

Linux provides a file change notification API called "dnotify", along with a command line utility dnotify. You can use that to keep track of the changes over the last 30s.

I would probably write an application that builds directly on the Linux API, and discards all events older than 30s.

Martin v. Löwis
Thank you, I was hoping there is something already existing.
smint
A: 

lsof will list all open files for a given process:

lsof -p

ennuikiller
+2  A: 

'strace -e trace=file' will show you exactly what files your application is reading and writong

PiedPiper
Will strace work on an entire process tree, or just one process?
Chris Kaminski
It won't work on a whole tree but you can use the '-p pid' option to attach to up to 32 processes
PiedPiper
or use '-f' to trace child processes as they are created by currently traced processes as a result of the fork(2) system call
PiedPiper