[dtrace-discuss] How to monitor any access to a specific file using drace

[Brendan Gregg - Sun Microsystems]

G'Day David,

On Sun, Jan 21, 2007 at 11:59:28PM -0800, David Chen wrote:
> Hi dtrace experts,
> I'm a newbie of dtrace, currently I meet a problem about how to monitor any access(maybe vi, cat, more, rm, cp, ls, even from process, etc) to a specific file, and then log the access info (user id/process id, date and time, command).
> I tried "iosnoop" in dtrace toolkits but seems only "vi" operation is detected, can anyone provide some suggestion?

iosnoop measures actual disk events; most file I/O will be cached, and
not make it to disk. This file I/O is also observable from DTrace using
the syscall provider, the fsinfo provider, and if needed the kernel VFS
interface via the fbt provider. The DTraceToolkit also has tools 
that observe this behaviour from different angles, such as rwsnoop
and pathopens.

Brendan

-- 
Brendan
[CA, USA]