Demonstrations of opensnoop, the Linux ftrace version.


# ./opensnoop
Tracing open()s. Ctrl-C to end.
COMM             PID      FD FILE
opensnoop        5334    0x3 
<...>            5343    0x3 /etc/ld.so.cache
opensnoop        5342    0x3 /etc/ld.so.cache
<...>            5343    0x3 /lib/x86_64-linux-gnu/libc.so.6
opensnoop        5342    0x3 /lib/x86_64-linux-gnu/libm.so.6
opensnoop        5342    0x3 /lib/x86_64-linux-gnu/libc.so.6
<...>            5343    0x3 /usr/lib/locale/locale-archive
<...>            5343    0x3 trace_pipe
supervise        1684    0x9 supervise/status.new
supervise        1684    0x9 supervise/status.new
supervise        1688    0x9 supervise/status.new
supervise        1688    0x9 supervise/status.new
supervise        1686    0x9 supervise/status.new
supervise        1685    0x9 supervise/status.new
supervise        1685    0x9 supervise/status.new
supervise        1686    0x9 supervise/status.new
[...]

The first several lines show opensnoop catching itself initializing.


Use -h to print the USAGE message:

# ./opensnoop -h
USAGE: opensnoop [-htx] [-d secs] [-p PID] [-L TID] [-n name] [filename]
                 -d seconds      # trace duration, and use buffers
                 -n name         # process name to match on open
                 -p PID          # PID to match on open
                 -L TID          # thread id to match on open
                 -t              # include time (seconds)
                 -x              # only show failed opens
                 -h              # this usage message
                 filename        # match filename (partials, REs, ok)
  eg,
       opensnoop                 # watch open()s live (unbuffered)
       opensnoop -d 1            # trace 1 sec (buffered)
       opensnoop -p 181          # trace I/O issued by PID 181 only
       opensnoop conf            # trace filenames containing "conf"
       opensnoop 'log$'          # filenames ending in "log"

See the man page and example file for more info.