|filelife(8)||System Manager's Manual||filelife(8)|
filelife - Trace the lifespan of short-lived files. Uses Linux eBPF/bcc.
filelife [-h] [-p PID]
This traces the creation and deletion of files, providing information on who deleted the file, the file age, and the file name. The intent is to provide information on short-lived files, for debugging or performance analysis.
This works by tracing the kernel vfs_create() and vfs_delete() functions (and maybe more, see the source) using dynamic tracing, and will need updating to match any changes to these functions.
This makes use of a Linux 4.4 feature (bpf_perf_event_output()); for kernels older than 4.4, see the version under tools/old, which uses an older mechanism.
Since this uses BPF, only the root user can use this tool.
CONFIG_BPF and bcc.
- Trace all short-lived files, and print details:
- # filelife
- Trace all short-lived files created AND deleted by PID 181:
- # filelife -p 181
This traces the kernel VFS file create and delete functions and prints output for each delete. As the rate of this is generally expected to be low (< 1000/s), the overhead is also expected to be negligible. This is from bcc.
Also look in the bcc distribution for a companion _examples.txt file containing example usage, output, and commentary for this tool.
Unstable - in development.