How to Use the Command 'fatrace' (with examples)

The fatrace command is a powerful tool used to monitor and report file access events within a system. This command is incredibly useful for system administrators and developers as it allows them to track, in real time, when and how files are being accessed. This can be particularly important for security monitoring, debugging, or optimizing system performance. By making use of its detailed output, users can gain insights into how applications interact with the filesystem, which can help identify unwanted behavior or inefficiencies.

Use case 1: Print file access events in all mounted filesystems to stdout

Code:

sudo fatrace

Motivation: Using sudo fatrace without any additional options allows you to observe all file access events across all mounted filesystems on your machine. This can be essential for a system administrator or a security analyst who needs to monitor the entire system for unauthorized access or to diagnose issues across different filesystems. It provides a comprehensive overview that can be crucial for understanding system-wide activities.

Explanation:

• sudo: This command is prefixed with sudo because monitoring file access events generally requires administrative privileges. Without sudo, you may not have permission to monitor every part of the system.
• fatrace: Invokes the fatrace tool to start reporting file access events. By running it without additional flags, it defaults to monitoring all events on all mounted filesystems.

Example output: This might look something like the following:

evince(12345): W /home/user/Documents/report.pdf
bash(54321): R /etc/passwd
firefox(23456): C /tmp/mozilla_temp
chrome(23459): RM /home/user/Caches/chrome_cache/somefile.tmp

• Each line represents a file access event, where:
  • The first part is the application accessing the file (e.g., evince, chrome).
  • The number in parentheses is the process ID (PID).
  • The letter indicates the type of operation, such as read (R), write (W), or close (C).
  • And finally, the filepath illustrates which file is being accessed.

Use case 2: Print file access events on the mount of the current directory, with timestamps, to stdout

Code:

sudo fatrace -c -t

Motivation: By focusing on the mount of the current directory and including timestamps with the -c and -t options, this command lets users narrow down file access tracking to the context of the current working directory, with the added context of when exactly these accesses occur. This is incredibly useful for developers or system engineers troubleshooting a specific application or directory. They can monitor how specific processes interact with files in a particular location over time, which is handy for narrowing down suspicious activity or debugging timing-related issues.

Explanation:

• sudo: As before, sudo is required to ensure that the command has adequate permissions to track all relevant events.
• fatrace: Initiates the monitoring of file access events.
• -c | --current-mount: This flag tells fatrace to limit its scope to the current filesystem mount. This is useful for reducing noise and focusing on a specific area of interest in the filesystem.
• -t | --timestamp: This option adds a timestamp to each reported event, providing precise timing details essential for performance monitoring or debugging chronologically sensitive operations.

Example output: The output with timestamps might look like this:

12:34:56.789 evince(12345): W Documents/report.pdf
12:35:00.123 bash(54321): R etc/passwd
12:35:10.456 firefox(23456): C tmp/mozilla_temp
12:35:20.789 chrome(23459): RM Caches/chrome_cache/somefile.tmp

• Each entry is prefixed with the time when the access event occurred in HH:MM:SS.mmm format.

Conclusion:

By using fatrace you can gain invaluable insights into the access patterns of applications on your filesystems. Whether you are monitoring a complete system for unauthorized activity or debugging specific issues in a particular directory, fatrace can cater to a range of needs with its diverse use cases and options. These two examples illustrate how you can deploy fatrace to either obtain a broad picture of your system’s file access behaviors or focus deeply on specific areas and events of interest with precise timing.