2

I'm quite new to Linux and I have not really a clue on how to do this.

I've got a directory and I'd like to monitor (output to shell) when a file inside that directory get's a file lock and when it is released.

It would be okay to know as well other things, like when a file is created and similar, but I'm mainly interested about the locks.

I don't need to know which process does the lock, it's more about the order in which this happens.

I'm pretty sure some tool for this exists (I already installed dtrace but after --help I decided to ask a question here).

Any pointers warm-heartedly appreciated. I'm running a fedora 14 box if that matters.

Improve this question
2
  • Have a look at this answer: unix.stackexchange.com/questions/6068/… Commented Oct 5, 2011 at 22:27
  • @StéphaneGimenez: The suggestion was really good, but I totally failed with both approaches. But that's my fault (not able to get LoggedFS to build and auditctl is installed but I can't get it log because of some errors). Commented Oct 5, 2011 at 23:26

1 Answer 1

Reset to default
3

I haven't checked that you will get what you want with it, but the first thing I'd try is the audit subsystem. Make sure that the auditd daemon is started, then use auditctl to configure what you want to log. For ordinary filesystem accesses, you would do

auditctl -w /path/to/directory auditctl -a exit,always -S fnctl -S open -S flock -F dir=/path/to/directory

The -S option can be used to restrict the logging to specific syscalls. The logs appear in /var/log/audit/audit.log on Debian, and probably on Fedora as well.

If you do know which process(es) may lock the file, then consider running strace on these processes (and only looking at the file-related system calls, or further restricting to specific syscalls).

strace -s9999 -o foo.strace -e file foo
Improve this answer
8
  • auditctl -a exit,always -w /path/to/directory -> Error: watch option can't be given with a syscall, I already learned that exit is related to syscall from the manpage. But it didn't help me ;). About strace, I have not tried, as I test a process I launch and it exists (like PHP CGI, but in CLI), is there an option to make strace start the command like with dbg? I think I should be able to dig through the strace output, should be interesting anyway. Commented Oct 5, 2011 at 23:30
  • just installed strace, I already see I can add the command behind, will try with it --- edit: this is cool! Commented Oct 5, 2011 at 23:43
  • @hakre Oops, -w implicitly sets -a. Fixed. In the forme I've given, strace starts the command foo. To attach to a running process, use strace -p1234 where 1234 is the pid. Commented Oct 5, 2011 at 23:43
  • when I remove -S fnctl,open I get auditctl to run and can see the log (same location as on debian). If I don't remove it, I get: Syscall name unknown: fnctl,open. I think fnctl is especially interesting regarding the file-locks. - edit just seeing, it's probably fcntl. However the error message is still the same, maybe the , is not correct or something, will check the manpage. strace does not show any log information. Commented Oct 6, 2011 at 0:06
  • I got this to run now: auditctl -a exit,always -F arch=b64 -S fcntl -S open -F dir=/path/to/dir, but it looks like that I still get no locking info (at least not the one I'm looking for, it's a PHP script, I might need to look into PHP sources if I'm looking in the wrong place). Thanks for your help so far, this is the second time! Commented Oct 6, 2011 at 0:19

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.