If on the other hand you run find like this cd /tmp find. Note : If you want to exclude /tmp/foo/bar and you run find like this " find /tmp \(." then you must specify -path /tmp/foo/bar. This comes from an actual use case, where I needed to call yui-compressor on some files generated by wintersmith, but leave out other files that need to be sent as-is. The way -prune works is that anything that, once it is reached, the files below that directory are permanently ignored. One might ask if adding -not will not make all other files hidden by -prune reappear, and the answer is no. This is then grouped as a single expression with the escaped parenthesis, and prefixed with -not which will make find skip anything that was matched by that expression. Inside \( and \) is an expression that will match exactly build/external (see important note above), and will, on success, avoid traversing anything below. See note if you'd like a better understanding. If this sentence confuses you just make sure to use full paths through out the whole command like this: find /full/path/ -not \( -path /full/path/exclude/this -prune \). Important Note: the paths you type after -path must exactly match what find would print without the exclusion. Lr-x- 1 abc abc 64 Jul 16 22:19 125 -> /home/abc/.config/google-chrome/Dictionaries/en-US-3-0.bdicĪnother way is to use lsof and grep $ lsof | grep "chrome"Ĭhrome 2204 abc cwd DIR 8,5 4096 1441794 /home/abcĬhrome 2204 abc txt REG 8,5 87345336 5111885 /opt/google/chrome/chromeĬhrome 2204 abc mem REG 8,5 4202496 1443927 /home/abc/.cache/google-chrome/Default/Media Cache/data_3Ĭhrome 2204 abc mem REG 8,5 1056768 1443926 /home/abc/.cache/google-chrome/Default/Media Cache/data_2Ĭhrome 2204 abc mem REG 8,5 270336 1443925 /home/abc/.cache/google-chrome/Default/Media Cache/data_1Ĭhrome 2204 abc mem REG 8,5 45056 1443924 /home/abc/.I find the following easier to reason about than other proposed solutions: find build -not \( -path build/external -prune \) -name \*.jsįind build -not \( -path build/external -prune \) -not \( -path build/blog -prune \) -name \*.js Lrwx- 1 abc abc 64 Jul 16 22:19 123 -> /home/abc/.cache/google-chrome/Default/Cache/data_2 Lrwx- 1 abc abc 64 Jul 16 22:19 122 -> /home/abc/.cache/google-chrome/Default/Cache/data_1 Lrwx- 1 abc abc 64 Jul 16 22:19 121 -> /home/abc/.cache/google-chrome/Default/Cache/data_0 Lrwx- 1 ba abc 64 Jul 16 22:19 104 -> /home/abc/.config/google-chrome/Default/Cookies You can use ls and grep to find out the files used by chrome $ ls -l /proc/*/fd | grep "chrome" (I think older systems need auditctl -a exit,always -w /path/to/file) and watch the logs in /var/log/audit/audit.log. Here, it should be enough to make sure the daemon is started, then run auditctl: auditctl -w /path/to/file There isn't much literature about it (but more than about loggedfs) you can start with this tutorial or a few examples or just with the auditctl man page. Under Linux, you can use the relatively new audit subsystem. Many unices offer other monitoring facilities. loggedfs -l /path/to/log_file -c /path/to/config.xml /path/to/directory Start with the provided sample configuration file and tweak it according to this guide. You'll want to log accesses to the directory where the file is created. The logging parameters are highly configurable. LoggedFS is a FUSE stacked filesystem that logs all accesses to files in a hierarchy. If you can plan a little in advance, you can put the file on a LoggedFS filesystem. If you need to watch a particular file and react when it is accessed, you need different tools. Lsof won't tell you about file that were opened two microseconds ago and closed one microsecond ago. lsof is available for just about every unix variant. The lsof command (already mentioned in several answers) will tell you what process has a file open at the time you run it.
0 Comments
Leave a Reply. |