CORE::GLOBAL::* for auditing which files are read and written?

[tim.bunce]

I'm trying to understand the behaviour of several big perl apps that use many custom modules. They read and write lots of files in a directory tree.

I'd like to be able to get a list of which files were read or written by the process.

I was hoping there would be a handy module on CPAN which would override CORE::GLOBAL::open (and symlink, rename, etc. etc.) to keep a record of the calls and parameters.

I couldn't see one. Is there one I'm missing?

[moritz]

I know of no Perl solution, but in general you can (ab)use strace on most Unix systems, DTrace on Solaris, FreeBSD and MacOS X and FileMon on Windows.

There's a DTrace patch for perl floating around somewhere (you'll find a link to it in the p5p archives) that enables dtracing perl code (and not just the perl interpreter), I don't know if that's needed for the dtrace approach.

[Fletch]

Shouldn't; I believe that was for letting dtrace see into what perl is doing (so you'd be able to monitor sub entry/exit and what not at the perl level similar to how you can watch system calls at the kernel level). This snippet from a dtrace FAQ might even be enough:

dtrace -n 'syscall::open*:entry { printf("%s %s",execname,copyinstr(ar
+g0)); }'

I think last I looked there were some good dtrace intros at opensolaris.org if you want to extend or tweak that to show different stuff.

Update: And as to the original question Devel::Trace might also be of use (although for serious programs it'd be a boatload of output).

[ig]

Operating system audit tools might be sufficient if all you want is a list of files accessed.

[salva]

It can not be done that way, at least not in a completely shameless manner.

The current support for prototypes in perl 5 has some misfeatures that make impossible to replace a good number of builtins without limiting how they can be used (stat, truncate, etc.).

And the file test operators (i.e. -f), can not be overrided at all.

Maybe playing with the runops loop... thinking about new features for Devel::NYTProf?

[tim.bunce]

I thought the prototype issue had been resolved (in relation to getting autodie to work).

"thinking about new features for Devel::NYTProf?" - no, this is unrelated. Though I am thinking of adding an option to NYTProf to make builtins get treated as calls to xsubs.

[BrowserUk]

It wouldn't be hard to knock up a source filter to redirect calls to open, rename etc. through some custom subs. Since it would only be used for exploration, the usual objections would be mostly moot.

[alexlc]

Tim:


Per the perldoc:
http://perldoc.perl.org/CORE.html
... you can globally override CORE::GLOBAL::open with your own function.

It was a bit harder to do than I though though...

BEGIN {
  *CORE::GLOBAL::open = sub (*;$@) {
    ($package, $filename, $line) = caller();
    print "LOGGING: intercepted `open` call from ( package: '$package'
+, file: '$filename', line: '$line' ) with args: '??', ".join(", ",map
+{ "'$_'" } @_) . "\n";
    if(defined($_[0])) {
      use Symbol qw();
      my $handle = Symbol::qualify($_[0],(caller)[0]);
      no strict 'refs';
      if(@_ == 1) {
        return CORE::open($handle);
      }
      elsif(@_ == 2) {
        return CORE::open($handle, $_[1]);
      }
      else {
        return CORE::open($handle, $_[1], @_[2..$#_]);
      }
    }
    else {
      if(@_ == 1) {
        return CORE::open($_[0]);
      }
      elsif(@_ == 2) {
        return CORE::open($_[0], $_[1]);
      }
      else {
        return CORE::open($_[0], $_[1], @_[2..$#_]);
      }
    }
  };
}

open(my $fh, "<", ".bashrc") or die "unable to use hacked up open func
+tion: $!";
my $top = <$fh>;
print $top;


Which returns:


LOGGING: intercepted `open` call from ( package: 'main', file: './core
+over.pl', line: '34' ) with args: '??', '', '<', '.bashrc'
# ~/.bashrc: executed by bash(1) for non-login shells.

Note: i had done this before, but couldn't quite remember how to make it work with open($fh ..) instead of open(FH ..), so perl.com helped me out:
http://www.perl.com/pub/a/2002/06/11/threads.html?page=2