filelife - Trace the lifespan of short-lived files. Uses Linux eBPF/bcc.
filelife [-h] [-p PID]
This traces the creation and deletion of files, providing information on who
deleted the file, the file age, and the file name. The intent is to provide
information on short-lived files, for debugging or performance analysis.
This works by tracing the kernel vfs_create() and vfs_delete() functions (and
maybe more, see the source) using dynamic tracing, and will need updating to
match any changes to these functions.
This makes use of a Linux 4.5 feature (bpf_perf_event_output()); for kernels
older than 4.5, see the version under tools/old, which uses an older
Since this uses BPF, only the root user can use this tool.
CONFIG_BPF and bcc.
- Print usage message.
- -p PID
- Trace this process ID only (filtered in-kernel).
- Trace all short-lived files, and print details:
- # filelife
- Trace all short-lived files created AND deleted by PID
- # filelife -p 181
- Time of the deletion.
- Process ID that deleted the file.
- Process name for the PID.
- Age of the file, from creation to deletion, in
This traces the kernel VFS file create and delete functions and prints output
for each delete. As the rate of this is generally expected to be low (<
1000/s), the overhead is also expected to be negligible. This is from bcc.
Also look in the bcc distribution for a companion _examples.txt file containing
example usage, output, and commentary for this tool.
Unstable - in development.