How to track file lifetime using lsof?

2/1/24, 9:58 AM

I have read article https://tailscale.com/blog/case-of-spiky-file-descriptors/ where author investigates anomalies with the amount of open file descriptors. He said that made snapshot of open files using lsof which allowed him to track lifetime of file:

01:12:17.24    tailcontr 142810 ubuntu  273u     IPv6   5725049    0t0     TCP 172.31.10.244:https->1.2.3.4:57666 (ESTABLISHED)
01:13:32.17    tailcontr 142810 ubuntu  273u     IPv6   5725049    0t0     TCP 172.31.10.244:https->1.2.3.4:57666 (CLOSE_WAIT)
01:14:03.22    tailcontr 142810 ubuntu  273u     sock       0,8    0t0 5725049 protocol: TCPv6
01:16:53.93    (socket is removed)

What flags should be used to track lifetime of file as given in the example above?

P.S: I want to investigate similar problem with TCPv6 connections. According to lsof -u <user> I have a lot of files looking like:

01:14:03.22    tailcontr 142810 ubuntu  273u     sock       0,8    0t0 5725049 protocol: TCPv6

And I want to understand where were these connections made to.

1 + 0

linux

lsof

socket

Score:1

Server

Romeo Ninov

2/1/24, 11:06 AM

In your case lsof will be not the exact tool. Better activate auditd and configure it to track creation and deletion of files. In /etc/audit.rules you can add something like

-w /path/to/file -p war -k fileops
-a always,exit -F dir=/path/to/ -S unlink -S unlinkat -S rename -S renameat  -k fileops

This will monitor read,write,append file operations. And delete (unlink) operations in the directory where the file is created.

The records later can be filtered by keyname fileops

+ 0

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: How to track file lifetime using lsof?

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.