How to find which files are opened by a Linux program?

How to find which files are opened by a Linux program? For example, when I run cat ~/.bashrc, how to find out which files are opened by cat?

You can achieve this by using strace if the program “open” files using system calls.

For example, I run as this:

strace -o /tmp/st cat ./.bashrc
grep "^open" /tmp/st 

It will prints out:

open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
open("/lib64/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
open("/usr/lib/locale/locale-archive", O_RDONLY|O_CLOEXEC) = 3
open("./.bashrc", O_RDONLY)             = 3

These files are opened. You can inspect the trace file (/tmp/st) to check all system called invoked by the command (cat here).

Answered by Eric Z Ma.

Eric Z Ma

Eric is a father and systems guy. Eric is interested in building high-performance and scalable distributed systems and related technologies. The views or opinions expressed here are solely Eric's own and do not necessarily represent those of any third parties.

Leave a Reply

Your email address will not be published. Required fields are marked *