filegone(8)

🦋 filegone(8) · System Manager's Manual 🦋

✨ NAME ✨

okay so filegone is the tool that tells you why a file vanished 👀 It traces who deleted or renamed it. It runs on Linux eBPF/bcc, so it's giving low-level detective energy 🕵️‍♀️💅

🔮 SYNOPSIS 🔮

filegone [-h] [-p PID]

💖 DESCRIPTION 💖

this traces why a file went poof 💨 aka it's gone, deleted, or renamed, and tells you who did it 🫣

it works by tracing the kernel vfs_unlink(), vfs_rmdir(), and vfs_rename functions ✨

⚠️ bestie, this one uses BPF, so only the root user can use this tool. no cap, sorry not sorry 🙅‍♀️

🎀 REQUIREMENTS 🎀

you'll need CONFIG_BPF and bcc 🧚

💅 OPTIONS 💅

• -h — pulls up the usage message 📖
• -p PID — only traces this process ID 🎯 (filtered right in the kernel, so it's super efficient 💜)

🍓 EXAMPLES 🍓

Trace all file gone events:

# filegone

Trace file gone events caused by PID 181:

# filegone -p 181

📸 FIELDS 📸

• TIME — when the event happened ⏰
• PID — the process ID that renamed or deleted the file 🫶
• COMM — the process name for that PID 🏷️
• ACTION — what happened to the file: DELETE or RENAME 💀
• FILE — the filename 📄

🌸 OVERHEAD 🌸

this traces the kernel VFS file rename and delete functions and prints output for each event. the rate is generally expected to be low (< 1000/s), so the overhead is also expected to be negligible ✨ it comes from bcc 🦋

the bcc repo lives here:

https://github.com/iovisor/bcc

also, lowkey important: check the bcc distribution for a companion _examples.txt file 📚 it has example usage, output, and commentary for this tool. iykyk 🙈

🌈 OS 🌈

Linux 🐧

🧪 STABILITY 🧪

Unstable - still in development 🚧 so it might be a little chaotic rn 😭

👑 AUTHOR 👑

Curu Wong 💜

🔗 SEE ALSO 🔗

filelife(8) 🧚

---

okay that's the whole tea 🫶 go forth and catch those vanishing files 🔥✨ love u bestie, bye 💖 (source: USER COMMANDS, dated 2022-11-18 🎀)