Logging system file calls from any Unix program

[aufflick]

As almut suggested, there are a number of tools (varying by flavour of Un*x) which let you watch the system calls made by a running program, regardless of what language it may be.

For Linux, the program is strace, and you do something like this:

$ strace perl -e 'open FOO, ">/tmp/foo"; print FOO "bar";'

...snip...

open("/tmp/foo", O_WRONLY|O_CREAT|O_TRUNC|O_LARGEFILE, 0666) = 3
ioctl(3, SNDCTL_TMR_TIMEBASE, 0xbfffe2f0) = -1 ENOTTY (Inappropriate i
+octl for device)
_llseek(3, 0, [0], SEEK_CUR)            = 0
fstat64(3, {st_mode=S_IFREG|0644, st_size=0, ...}) = 0
fcntl64(3, F_SETFD, FD_CLOEXEC)         = 0
brk(0)                                  = 0x8143000
brk(0x8144000)                          = 0x8144000
write(3, "bar", 3)                      = 3
close(3)                                = 0
exit_group(0)                           = ?

See the open in the first line? That's a call to the system function open. You can find out what all the arguments mean by running man 2 open in your shell. The 3 at the end of that line is the return of that function - it is the file handle for that opened file. You can then follow the write and close functions that relate to that file.

You can use strace to watch what a running program is doing with the -p option, but be careful of doing this on a production box as some older versions of the linux kernel have a bug that could cause your program to halt when you exit strace.

The equivalent of strace on Solaris is truss. On MacOS X you need a combination of ktrace and kdump (read both man pages).