I'm writing a program to be run from the Linux user space which spawns another process. How can it determine which files were modified by the spawned process after it completes?
A:
Inject your own replacement for fopen(3) that records the names and modes.
Ignacio Vazquez-Abrams
2010-03-12 19:11:04
I think the proper jargon here is "library interposition". It's not a bad idea but doesn't seem to work for some reason on the program that I'm trying to monitor (g++). I'm only seeing accesses to files in /tmp.
balor123
2010-03-12 19:50:01
Didn't know about this program - thanks for the hint! Shows a lot more than wrapping fopen() but still doesn't catch writes from g++.
balor123
2010-03-12 19:52:37
@balor: What are you doing with g++ that you don't know what files it writes? Normally it only modifies a single file and you can give the name on the command line.
Roger Pate
2010-03-12 19:56:58
A:
Maybe g++ itself spawns other processes? Than "strace -fF -efile program" plus some filtering will probably help you.
fungusakafungus
2010-03-12 21:25:49