Tracing files accessed by a process

Dag-Erling Smørgrav des at
Wed May 18 00:43:25 GMT 2005

Stanislav Sedov <stas at> writes:
> On Tue, May 17, 2005 at 09:21:05AM -0700, Stephan Wehner wrote:
> > What would be the recommended way to obtain the list of files that a
> > process has accessed, from start to finish?
> You can use ktrace program and then analyze it output (open(2) calls).

you need to track NAMI operations; open(2) is not (by far) the only
syscall that can reference a file by its name.  'ktrace -tn' is your

Dag-Erling Smørgrav - des at

More information about the freebsd-fs mailing list