Projects / TrackFS

TrackFS

Trackfs is a small program that tracks file system changes made by another program (or group of programs). It is similar to "installwatch", but works quite differently. While installwatch uses LD_PRELOAD to intercept library functions like open() and unlink(), trackfs runs the child program(s) with tracing enabled and tracks the system calls they make.

Tags
Licenses
Operating Systems

RSS Recent releases

  •  25 Mar 2009 20:43

    Release Notes: trackfs and trexec now understand the new "*at" system calls (i.e. openat, mkdirat, and so on). They handle invalid arguments like NULL pointers more gracefully than earlier versions, and use fewer ptrace() calls. There also is an experimental new program called "playback" that executes an arbitrary command and creates a "restore script" that can be used to undo the changes the command has performed.

    •  02 May 2008 10:47

    Release Notes: This release adds a new "trexec" program. It has improved execve() handling, in particular in biarch (32/64-bit) environments.

    •  21 Jun 2006 11:15

    Release Notes: This release should work on i386 systems again (was broken in 0.0.5).

    •  19 Jun 2006 13:52

    Release Notes: Trackfs no longer fails when a child exits before the parent has returned from its fork() call. This used to happen with the latest (2.6.17) Linux kernels.

    •  17 Nov 2005 23:27

    Release Notes: Forks are processed serially now. This should avoid the problems trackfs had with some Perl scripts (e.g. pod2man). 32-bit (i386) versions of trackfs will now complain if they're about to execute a 64-bit (x86_64) binary. More bugfixes were made.

    Screenshot

    Project Spotlight

    Lziprecover

    A recovery tool for lzip files.

    Screenshot

    Project Spotlight

    Observium

    An autodiscovering network observation system.