NAME

       fatrace - report system wide file access events

SYNOPSIS

       fatrace [ OPTIONS ]

DESCRIPTION

       fatrace reports file access events from all running processes.

       It  does  not  report  file  access  by  fatrace itself, to avoid logging events caused by
       writing the output into a file. It also ignores events on virtual and kernel file  systems
       such as sysfs, proc, and devtmpfs.

       Its main purpose is to find processes which keep waking up the disk unnecessarily and thus
       prevent some power saving.

       By default, events are reported to stdout. This will cause some loops if you run this tool
       in  e.  g.  gnome-terminal,  as  this causes a disk access for every output line. To avoid
       this, redirect the output into a file.

OUTPUT FORMAT

       A typical event looks like

           rsyslogd(875): W /var/log/auth.log
           compiz(1971): O device 8:2 inode 658203

       The line has the following fields:

       • Process name. This is read from  /proc/pid/comm,  and  might  be  abbreviated  for  long
         process names.

       • Process ID

       • Event  type:  Open,  Read,  Write,  or  Close. Combinations are possible, such as CW for
         closing a written file.

       • Affected file. In some cases the path and name cannot be determined, e. g.   because  it
         is a temporary file which is already deleted. In that case, it prints the devices' major
         and minor number and the inode number. To examine such a process  in  more  detail,  you
         should consider using strace(1).

       If you specify the --timestamp option, the first field will be the current time.

OPTIONS

       -c, --current-mount
              Only  record  events  on partition/mount of current directory. Without this option,
              all (real) partitions/mount points are being watched.

       -o FILE, --output=FILE
              Write events to given file instead of standard output.

       -s SECONDS, --seconds=SECONDS
              Stop after the given number of seconds.

       -t, --timestamp
              Add timestamp to events. When this option is given once, the format will be a human
              readable hour:minute:second.microsecond; when given twice, the timestamp is printed
              as seconds/microseconds since the epoch.

       -p PID, --ignore-pid=PID
              Ignore events for this process ID. Can be specified multiple times.

       -h , --help
              Print help and exit.

AUTHOR

       fatrace is developed by Martin Pitt <martin.pitt@ubuntu.com>.