lsof监视目录下所有文件的访问情况(含子目录)
lsof +D /tmp -r 1
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
fcitx-imp 7104 yeqiang 4w REG 0,50 0 106 ./fcitx_yeqiang_inotify.log
deepin-de 8155 yeqiang 5uW REG 0,50 0 132 ./deepin-deepinid-daemon-1000.lock
com.aliba 8171 yeqiang 3uW REG 0,50 0 146 ./dingtalk
bash 8991 yeqiang cwd DIR 0,50 1140 1 .
sogoupiny 9124 yeqiang 12uW REG 0,50 5 246 ./sogoupinyin-qimpanel-watchdog-1000:0.pid
sogoupiny 10182 yeqiang 26uW REG 0,50 6 148 ./sogoupinyin-qimpanel-1000:0.pid
lsof 10380 yeqiang cwd DIR 0,50 1140 1 .
lsof 10381 yeqiang cwd DIR 0,50 1140 1 .
VBoxXPCOM 29646 yeqiang 3wW REG 0,50 6 2879 ./.vbox-yeqiang-ipc/lock
=======
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
fcitx-imp 7104 yeqiang 4w REG 0,50 0 106 ./fcitx_yeqiang_inotify.log
deepin-de 8155 yeqiang 5uW REG 0,50 0 132 ./deepin-deepinid-daemon-1000.lock
com.aliba 8171 yeqiang 3uW REG 0,50 0 146 ./dingtalk
bash 8991 yeqiang cwd DIR 0,50 1140 1 .
sogoupiny 9124 yeqiang 12uW REG 0,50 5 246 ./sogoupinyin-qimpanel-watchdog-1000:0.pid
sogoupiny 10182 yeqiang 26uW REG 0,50 6 148 ./sogoupinyin-qimpanel-1000:0.pid
lsof 10380 yeqiang cwd DIR 0,50 1140 1 .
VBoxXPCOM 29646 yeqiang 3wW REG 0,50 6 2879 ./.vbox-yeqiang-ipc/lock
inotifywait 监视目录访问情况
inotifywait -m -r /tmp
Setting up watches. Beware: since -r was given, this may take a while!
Watches established.
/tmp/ OPEN fcitx-log.log_yeqiang
/tmp/ CLOSE_WRITE,CLOSE fcitx-log.log_yeqiang
/tmp/ OPEN fcitx-log.log_yeqiang
/tmp/ CLOSE_WRITE,CLOSE fcitx-log.log_yeqiang
/tmp/ OPEN fcitx-log.log_yeqiang
/tmp/ CLOSE_WRITE,CLOSE fcitx-log.log_yeqiang
/tmp/ OPEN fcitx-log.log_yeqiang
/tmp/ CLOSE_WRITE,CLOSE fcitx-log.log_yeqiang
/tmp/ OPEN fcitx-log.log_yeqiang
/tmp/ CLOSE_WRITE,CLOSE fcitx-log.log_yeqiang
/tmp/ OPEN fcitx-log.log_yeqiang
/tmp/ CLOSE_WRITE,CLOSE fcitx-log.log_yeqiang
/tmp/ OPEN fcitx-log.log_yeqiang
/tmp/ CLOSE_WRITE,CLOSE fcitx-log.log_yeqiang
/tmp/ OPEN fcitx-log.log_yeqiang
/tmp/ CLOSE_WRITE,CLOSE fcitx-log.log_yeqiang
/tmp/ OPEN fcitx-log.log_yeqiang
/tmp/ CLOSE_WRITE,CLOSE fcitx-log.log_yeqiang
/tmp/ OPEN fcitx-log.log_yeqiang
/tmp/ CLOSE_WRITE,CLOSE fcitx-log.log_yeqiang
/tmp/ OPEN fcitx-log.log_yeqiang
/tmp/ CLOSE_WRITE,CLOSE fcitx-log.log_yeqiang
/tmp/ OPEN fcitx-log.log_yeqiang
/tmp/ CLOSE_WRITE,CLOSE fcitx-log.log_yeqiang
/tmp/ OPEN fcitx-log.log_yeqiang
/tmp/ CLOSE_WRITE,CLOSE fcitx-log.log_yeqiang
lsof可以看到访问文件系统的进程信息,inotifywait能看到详细的操作事件。