1
tensorzhang 2023-05-19 15:28:05 +08:00
watchdog ?
|
2
aloxaf 2023-05-19 15:32:17 +08:00
fanotify ?
|
3
garychenlin 2023-05-19 15:39:38 +08:00
audit ?
|
4
defunct9 2023-05-19 15:42:30 +08:00
go 写个 inotify
|
5
barathrum 2023-05-19 15:58:20 +08:00
systemtap 或 eBPF 之类的应该能做吧
|
6
LindsayZhou 2023-05-19 16:21:47 +08:00 1
搜了一下,bcc 的示例里已经有相关的了: https://github.com/iovisor/bcc/blob/master/tools/filetop.py
ebpf + kprobe ,要定制化自己简单改下就行了。 |
7
julyclyde 2023-05-20 17:07:14 +08:00
进程视角:strace
文件被动视角:inotify 开放视角:systemtap 、eBPF 之类的 |