1fatrace(8)                  System Manager's Manual                 fatrace(8)
2
3
4

NAME

6       fatrace - report system wide file access events
7
8

SYNOPSIS

10       fatrace [ OPTIONS ]
11
12

DESCRIPTION

14       fatrace reports file access events from all running processes.
15
16       It  does  not  report  file  access by fatrace itself, to avoid logging
17       events caused by writing the output into a file. It also ignores events
18       on virtual and kernel file systems such as sysfs, proc, and devtmpfs.
19
20       Its main purpose is to find processes which keep waking up the disk un‐
21       necessarily and thus prevent some power saving.
22
23       By default, events are reported to stdout. This will cause  some  loops
24       if you run this tool in e. g. gnome-terminal, as this causes a disk ac‐
25       cess for every output line. To avoid this, redirect the output  into  a
26       file.
27
28

OUTPUT FORMAT

30       A typical event looks like
31
32           rsyslogd(875): W /var/log/auth.log
33           compiz(1971): O device 8:2 inode 658203
34
35       The line has the following fields:
36
37
38       • Process name. This is read from /proc/pid/comm, and might be abbrevi‐
39         ated for long process names.
40
41
42       • Process ID
43
44
45       • Event type: Open, Read, Write, Close. Events  on  directories  are  +
46         (create),  Delete, < (moved from), or > (moved to).  Combinations are
47         possible, such as CW for closing a written file, or <> for renaming a
48         file within the same directory.
49
50         Directory events can only be detected on Linux 5.1 or higher.
51
52
53       • Affected  file. In some cases the path and name cannot be determined,
54         e. g.  because it is a temporary file which is  already  deleted.  In
55         that  case, it prints the devices' major and minor number and the in‐
56         ode number. To examine such a process in more detail, you should con‐
57         sider using strace(1).
58
59       If you specify the --timestamp option, the first field will be the cur‐
60       rent time.
61
62

OPTIONS

64       -c, --current-mount
65              Only record events  on  partition/mount  of  current  directory.
66              Without  this option, all (real) partitions/mount points are be‐
67              ing watched.
68
69
70       -o FILE, --output=FILE
71              Write events to given file instead of standard output.
72
73
74       -s SECONDS, --seconds=SECONDS
75              Stop after the given number of seconds.
76
77
78       -t, --timestamp
79              Add timestamp to events. When this option  is  given  once,  the
80              format  will be a human readable hour:minute:second.microsecond;
81              when given twice, the timestamp is printed as  seconds/microsec‐
82              onds since the epoch.
83
84
85       -p PID, --ignore-pid=PID
86              Ignore  events  for  this  process ID. Can be specified multiple
87              times.
88
89
90       -f TYPES, --filter=TYPES
91              Show only the given event types.  TYPES is a list of C, R, O, W,
92              D, +, or < with the above meanings. < and > both mean "move" and
93              will always enable both directions.
94
95              E. g. use --filter=OC to only show open and close events.
96
97
98       -C COMMAND, --command=COMMAND
99              Show only events for this command.
100
101
102       -h , --help
103              Print help and exit.
104
105

AUTHOR

107       fatrace is developed by Martin Pitt <martin@piware.de>.
108
109
110
111Martin Pitt                     August 20, 2020                     fatrace(8)