Projects / TrackFS


Trackfs is a small program that tracks file system changes made by another program (or group of programs). It is similar to "installwatch", but works quite differently. While installwatch uses LD_PRELOAD to intercept library functions like open() and unlink(), trackfs runs the child program(s) with tracing enabled and tracks the system calls they make.

Operating Systems

Recent releases

  •  04 Mar 2013 21:44

    Release Notes: trackfs now also works on ARM systems (EABI only). On x86_64 systems, it can handle x32 binaries (provided that the kernel isn't too old).

    •  25 Mar 2009 18:17

      Release Notes: trackfs and trexec now understand the new "*at" system calls (i.e. openat, mkdirat, and so on). They handle invalid arguments like NULL pointers more gracefully than earlier versions, and use fewer ptrace() calls. There also is an experimental new program called "playback" that executes an arbitrary command and creates a "restore script" that can be used to undo the changes the command has performed.

      •  02 May 2008 17:47

        Release Notes: This release adds a new "trexec" program. It has improved execve() handling, in particular in biarch (32/64-bit) environments.

        •  21 Jun 2006 18:15

          Release Notes: This release should work on i386 systems again (was broken in 0.0.5).

          •  19 Jun 2006 20:52

            Release Notes: Trackfs no longer fails when a child exits before the parent has returned from its fork() call. This used to happen with the latest (2.6.17) Linux kernels.


            Project Spotlight


            A Fluent OpenStack client API for Java.


            Project Spotlight

            TurnKey TWiki Appliance

            A TWiki appliance that is easy to use and lightweight.