filegone(8)

🦋 NAME 🦋

okay so this is filegone(8) from the System Manager's Manual, and it's literally here to help you trace why a file is gone. The official vibe: filegone — Trace why file gone (deleted or renamed). Uses Linux eBPF/bcc. 💖

✨ SYNOPSIS ✨

filegone [-h] [-p PID]

🌸 DESCRIPTION 🌸

bestie, this tool traces why a file is gone/vanished, and it gives you the info on who deleted or renamed the file. 👀

It works by tracing the kernel vfs_unlink() , vfs_rmdir() , vfs_rename functions. (Yes, those exact functions — no cap.) 🧚

Since this uses BPF, only the root user can use this tool. 🔥

🎀 REQUIREMENTS 🎀

You need CONFIG_BPF and bcc. That's the whole requirements list, periodt. 💅

💜 OPTIONS 💜

• -h — Print usage message. simple as that 🫶
• -p PID — Trace this process ID only (filtered in-kernel). like, just that one PID, bestie 🎯

⭐ EXAMPLES ⭐

Trace all file gone events:

# filegone

Trace file gone events caused by PID 181:

# filegone -p 181

🌈 FIELDS 🌈

• TIME — Time of the event. ⏰
• PID — Process ID that renamed/deleted the file. 🆔
• COMM — Process name for the PID. 🏷️
• ACTION — action on file: 'DELETE' or 'RENAME' 👀
• FILE — Filename. 📄

🍓 OVERHEAD 🍓

This traces the kernel VFS file rename and delete functions and prints output for each event. As the rate of this is generally expected to be low (< 1000/s), the overhead is also expected to be negligible. ✨

This is from bcc — https://github.com/iovisor/bcc — and also look in the bcc distribution for a companion _examples.txt file containing example usage, output, and commentary for this tool. 🧚

💻 OS 💻

Linux 🐧

💀 STABILITY 💀

Unstable - in development. so like, handle with care, bestie 😭

👑 AUTHOR 👑

Curu Wong ✨

🫶 SEE ALSO 🫶

filelife(8) — go check that one too, iykyk 💖

---

mwah 💋 — source/version: USER COMMANDS; date: 2022-11-18; page: filegone(8). that's the whole manual, bestie, go trace those files! 🌟