bcc-filelife(8)

1filelife(8)                 System Manager's Manual                filelife(8)
2
3
4

NAME

6       filelife  -  Trace  the  lifespan  of  short-lived  files.  Uses  Linux
7       eBPF/bcc.
8

SYNOPSIS

10       filelife [-h] [-p PID]
11

DESCRIPTION

13       This traces the creation and deletion of files,  providing  information
14       on who deleted the file, the file age, and the file name. The intent is
15       to provide information on short-lived files, for debugging  or  perfor‐
16       mance analysis.
17
18       This  works  by  tracing the kernel vfs_create() and vfs_delete() func‐
19       tions (and maybe more, see the source) using dynamic tracing, and  will
20       need updating to match any changes to these functions.
21
22       This  makes  use  of a Linux 4.5 feature (bpf_perf_event_output()); for
23       kernels older than 4.5, see the version under tools/old, which uses  an
24       older mechanism.
25
26       Since this uses BPF, only the root user can use this tool.
27

REQUIREMENTS

29       CONFIG_BPF and bcc.
30

OPTIONS

32       -h     Print usage message.
33
34       -p PID Trace this process ID only (filtered in-kernel).
35

EXAMPLES

37       Trace all short-lived files, and print details:
38              # filelife
39
40       Trace all short-lived files created AND deleted by PID 181:
41              # filelife -p 181
42

FIELDS

44       TIME   Time of the deletion.
45
46       PID    Process ID that deleted the file.
47
48       COMM   Process name for the PID.
49
50       AGE(s) Age of the file, from creation to deletion, in seconds.
51
52       FILE   Filename.
53

OVERHEAD

55       This  traces the kernel VFS file create and delete functions and prints
56       output for each delete. As the rate of this is generally expected to be
57       low  (<  1000/s), the overhead is also expected to be negligible.  This
58       is from bcc.
59
60              https://github.com/iovisor/bcc
61
62       Also look in the bcc distribution for a  companion  _examples.txt  file
63       containing example usage, output, and commentary for this tool.
64

OS

66       Linux
67

STABILITY

69       Unstable - in development.
70

AUTHOR

72       Brendan Gregg
73