Monitor open files (via /proc/pid) of a process. Lists time when it first
sees the file open (which may be later than when the file actually opened,
especially at startup of filago), and when it is no longer open. Stop
running when target process ends.
This includes anon_inode and tcp and unix sockets.
*Only works on Linux or OSes supporting /proc in this manner.*
Usage of ./filago:
-d uint
Time granularity for checking files, in milliseconds (default 100)
-j Output json (complete json per line)
-l Turn on hostname lookup (default is a "-"
-r Show only real files, i.e. no pipes, sockets, etc.
Default simple text output as well as json output containing more extensive
information.
Example text output on Firefox process:
$ ./filago -l -j 3737
2017-05-07T12:40:40.663016-04:00 open socket:[416916] tcp
198.252.206.25:443 stackoverflow.com.
2017-05-07T12:40:40.663016-04:00 open anon_inode:[eventpoll]
2017-05-07T12:40:40.663016-04:00 open socket:[511791] unix -
2017-05-07T12:40:40.663016-04:00 open
/home/bsmith/.cache/event-sound-cache.tdb.9bf539dba0e34f7aaf456bd844b6826e.x86_64-redhat-linux-gnu
2017-05-07T12:40:40.663016-04:00 open socket:[1265977] unix -
2017-05-07T12:40:40.663016-04:00 open socket:[1574737] tcp
173.194.175.189:443 qs-in-f189.1e100.net.
2017-05-07T12:41:21.110231-04:00 close socket:[1630334] tcp
52.84.139.212:80 server-52-84-139-212.yto50.r.cloudfront.net.
2017-05-07T12:42:35.083678-04:00 open socket:[1635598]
2017-05-07T12:42:35.155006-04:00 close socket:[1635598]
2017-05-07T12:42:35.155006-04:00 open socket:[1630691] tcp
172.217.6.229:443 lga25s55-in-f5.1e100.net.
Example json output (complete json per line) on Firefox process:
$ ./filago -l -j 3737
{"filename":"socket:[95066]","type":"unix","socket_info":{"unix_socket":{"num":"ffff8803e6c99f80","refcount":"00000003","protocol":"00000000","flags":"00000000","type":"0001","st":"03","inode":95066}},"status":"open","mod_time":"1969-12-31T19:00:00-05:00"}
{"filename":"socket:[95067]","type":"unix","socket_info":{"unix_socket":{"num":"ffff8803e6c99c00","refcount":"00000003","protocol":"00000000","flags":"00000000","type":"0001","st":"03","inode":95067}},"status":"open","mod_time":"1969-12-31T19:00:00-05:00"}
{"filename":"pipe:[95068]","type":"pipe","status":"open","mod_time":"2017-06-02T23:20:10.616170585-04:00"}
{"filename":"/home/bsmith/install/firefox/omni.ja","type":"file","status":"open","mod_time":"2017-05-27T23:24:59.740556075-04:00"}
{"filename":"/home/bsmith/install/firefox/browser/omni.ja","type":"file","status":"open","mod_time":"2017-05-27T23:25:00.173556279-04:00"}
{"filename":"pipe:[95069]","type":"pipe","status":"open","mod_time":"2017-06-02T23:19:57.685144488-04:00"}
{"filename":"pipe:[110949]","type":"pipe","status":"open","mod_time":"2017-06-02T23:19:57.685144488-04:00"}
{"filename":"socket:[95070]","type":"other","status":"open","mod_time":"1969-12-31T19:00:00-05:00"}
{"filename":"pipe:[102268]","type":"pipe","status":"open","mod_time":"2017-06-02T23:20:13.688176034-04:00"}
{"filename":"/home/bsmith/.mozilla/firefox/uqsr6u0q.default/extension-data/ublock0.sqlite","type":"file","status":"open","mod_time":"2017-06-02T23:19:09.638842227-04:00"}
{"filename":"socket:[110951]","type":"unix","socket_info":{"unix_socket":{"num":"ffff880403259c00","refcount":"00000003","protocol":"00000000","flags":"00000000","type":"0001","st":"03","inode":110951}},"status":"open","mod_time":"1969-12-31T19:00:00-05:00"}
{"filename":"anon_inode:[eventfd]","type":"anon_inode","status":"open","mod_time":"2017-06-02T22:20:43.183999937-04:00"}
{"filename":"anon_inode:inotify","type":"anon_inode","status":"open","mod_time":"2017-06-02T22:20:43.183999937-04:00"}
{"filename":"socket:[109319]","type":"tcp","socket_info":{"inode":109319,"tcp_socket":{"rem_hostname":"a23-63-227-177.deploy.static.akamaitechnologies.com.","sl":4,"local_port":58795,"remote_port":80,"st":1,"tr":1,"uid":1000,"tx_queue":296,"tm_when":21,"extra":"3","rem_address":"23.63.227.177","local_address":"192.168.0.101"}},"status":"close","mod_time":"1969-12-31T19:00:00-05:00"}
{"filename":"socket:[106227]","type":"tcp","socket_info":{"inode":106227,"tcp_socket":{"rem_hostname":"a23-63-227-177.deploy.static.akamaitechnologies.com.","sl":1,"local_port":58796,"remote_port":80,"st":1,"tr":1,"uid":1000,"tx_queue":296,"tm_when":21,"extra":"3","rem_address":"23.63.227.177","local_address":"192.168.0.101"}},"status":"open","mod_time":"1969-12-31T19:00:00-05:00"}
{"filename":"socket:[106227]","type":"tcp","socket_info":{"inode":106227,"tcp_socket":{"rem_hostname":"a23-63-227-177.deploy.static.akamaitechnologies.com.","sl":1,"local_port":58796,"remote_port":80,"st":1,"tr":1,"uid":1000,"tx_queue":296,"tm_when":21,"extra":"3","rem_address":"23.63.227.177","local_address":"192.168.0.101"}},"status":"close","mod_time":"1969-12-31T19:00:00-05:00"}
{"filename":"socket:[111430]","type":"tcp","socket_info":{"inode":111430,"tcp_socket":{"rem_hostname":"a23-63-227-177.deploy.static.akamaitechnologies.com.","sl":2,"local_port":58797,"remote_port":80,"st":1,"tr":1,"uid":1000,"tx_queue":296,"tm_when":22,"extra":"3","rem_address":"23.63.227.177","local_address":"192.168.0.101"}},"status":"open","mod_time":"1969-12-31T19:00:00-05:00"}
{"filename":"socket:[111430]","type":"tcp","socket_info":{"inode":111430,"tcp_socket":{"rem_hostname":"a23-63-227-177.deploy.static.akamaitechnologies.com.","sl":2,"local_port":58797,"remote_port":80,"st":1,"tr":1,"uid":1000,"tx_queue":296,"tm_when":22,"extra":"3","rem_address":"23.63.227.177","local_address":"192.168.0.101"}},"status":"close","mod_time":"1969-12-31T19:00:00-05:00"}
{"filename":"socket:[106273]","type":"tcp","socket_info":{"inode":106273,"tcp_socket":{"rem_hostname":"ec2-34-211-94-203.us-west-2.compute.amazonaws.com.","sl":4,"local_port":47111,"remote_port":443,"st":1,"tr":1,"uid":1000,"tx_queue":193,"tm_when":21,"extra":"3","rem_address":"34.211.94.203","local_address":"192.168.0.101"}},"status":"open","mod_time":"1969-12-31T19:00:00-05:00"}
{"filename":"socket:[110114]","type":"tcp","socket_info":{"inode":110114,"tcp_socket":{"sl":4,"local_port":34260,"remote_port":80,"st":1,"tr":2,"uid":1000,"tm_when":987,"extra":"3","rem_address":"72.21.91.29","local_address":"192.168.0.101"}},"status":"open","mod_time":"1969-12-31T19:00:00-05:00"}
{"filename":"/home/bsmith/.cache/mozilla/firefox/uqsr6u0q.default/OfflineCache/index.sqlite","type":"file","status":"open","mod_time":"2015-05-27T06:40:57.729790739-04:00"}
{"filename":"socket:[106278]","type":"tcp","socket_info":{"inode":106278,"tcp_socket":{"sl":5,"local_port":42312,"remote_port":443,"st":1,"tr":1,"uid":1000,"tx_queue":187,"tm_when":20,"extra":"3","rem_address":"151.101.193.140","local_address":"192.168.0.101"}},"status":"open","mod_time":"1969-12-31T19:00:00-05:00"}
{"filename":"socket:[110116]","type":"tcp","socket_info":{"inode":110116,"tcp_socket":{"sl":2,"local_port":48623,"remote_port":443,"st":1,"tr":1,"uid":1000,"tx_queue":197,"tm_when":20,"extra":"3","rem_address":"151.101.1.140","local_address":"192.168.0.101"}},"status":"open","mod_time":"1969-12-31T19:00:00-05:00"}
{"filename":"socket:[110116]","type":"tcp","socket_info":{"inode":110116,"tcp_socket":{"sl":2,"local_port":48623,"remote_port":443,"st":1,"tr":1,"uid":1000,"tx_queue":197,"tm_when":20,"extra":"3","rem_address":"151.101.1.140","local_address":"192.168.0.101"}},"status":"close","mod_time":"1969-12-31T19:00:00-05:00"}
{"filename":"socket:[113560]","type":"tcp","socket_info":{"inode":113560,"tcp_socket":{"sl":6,"local_port":48628,"remote_port":443,"st":1,"tr":1,"uid":1000,"tx_queue":180,"rx_queue":258,"tm_when":21,"extra":"3","rem_address":"151.101.1.140","local_address":"192.168.0.101"}},"status":"open","mod_time":"1969-12-31T19:00:00-05:00"}
{"filename":"socket:[113560]","type":"tcp","socket_info":{"inode":113560,"tcp_socket":{"sl":6,"local_port":48628,"remote_port":443,"st":1,"tr":1,"uid":1000,"tx_queue":180,"rx_queue":258,"tm_when":21,"extra":"3","rem_address":"151.101.1.140","local_address":"192.168.0.101"}},"status":"close","mod_time":"1969-12-31T19:00:00-05:00"}
{"filename":"socket:[113617]","type":"tcp","socket_info":{"inode":113617,"tcp_socket":{"sl":5,"local_port":48631,"remote_port":443,"st":1,"tr":2,"uid":1000,"tm_when":999,"extra":"3","rem_address":"151.101.1.140","local_address":"192.168.0.101"}},"status":"open","mod_time":"1969-12-31T19:00:00-05:00"}
Any constructive input or feedback appreciated.
Already know: needs tests.... :-)
Thanks,
Glen
--
You received this message because you are subscribed to the Google Groups
"golang-nuts" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to golang-nuts+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
