filelife - Trace the lifespan of short-lived files. Uses Linux eBPF/bcc.

       Brendan Gregg

       This  traces  the creation and deletion of files, providing information on who deleted the file, the file
       age, and the file name. The intent is to provide information  on  short-lived  files,  for  debugging  or
       performance analysis.

       This works by tracing the kernel vfs_create() and vfs_delete() functions (and maybe more, see the source)
       using dynamic tracing, and will need updating to match any changes to these functions.

       This  makes  use  of  a  Linux 4.4 feature (bpf_perf_event_output()); for kernels older than 4.4, see the
       version under tools/old, which uses an older mechanism.

       Since this uses BPF, only the root user can use this tool.

       Trace all short-lived files, and print details:
              # filelife

       Trace all short-lived files created AND deleted by PID 181:
              # filelife-p181

       TIME   Time of the deletion.

       PID    Process ID that deleted the file.

       COMM   Process name for the PID.

       AGE(s) Age of the file, from creation to deletion, in seconds.

       FILE   Filename.

       filelife - Trace the lifespan of short-lived files. Uses Linux eBPF/bcc.

       -h     Print usage message.

       -p PID Trace this process ID only (filtered in-kernel).

       Linux

       This traces the kernel VFS file create and delete functions and prints output for  each  delete.  As  the
       rate  of this is generally expected to be low (< 1000/s), the overhead is also expected to be negligible.
       This is from bcc.

              https://github.com/iovisor/bcc

       Also look in the bcc distribution for a companion _examples.txt file containing  example  usage,  output,
       and commentary for this tool.

       CONFIG_BPF and bcc.

opensnoop(1)

USER COMMANDS                                      2016-02-08                                        filelife(8)

       Unstable - in development.

filelife[-h][-pPID]