filelife(8)

🎀 filelife(8) 🎀

Okay bestie, the filelife manual page is giving main character energy, so let's go through it together ✨

✨ NAME ✨

filelife is a tool that traces the lifespan of short-lived files 🦋 It uses Linux eBPF/bcc, so it's giving low-level kernel vibes 💅

💜 SYNOPSIS 💜

filelife [-h] [-p PID]

🌸 DESCRIPTION 🌸

Okay so this one traces files being created and deleted 📁 For every deletion, it tells you who deleted the file, how old the file was, and what its name was. The whole point is to catch short-lived files so you can debug stuff or do performance analysis 🔥

It works by tracing the kernel vfs_create() and vfs_delete() functions 🧚 There might be more it touches too, so check the source if you're curious 👀 It uses dynamic tracing to do this, which means it will need updating if those functions ever change. Not me having to babysit it 💀

This tool uses a Linux 4.4 feature called bpf_perf_event_output() ✨ If you're on a kernel older than 4.4, look in the version under tools/old. That one uses an older mechanism instead 🫶

Heads up: since this runs on BPF, only the root user can use this tool 🔐

🎀 REQUIREMENTS 🎀

You need CONFIG_BPF and bcc 💖

✨ OPTIONS ✨

• -h — Pulls up the usage message 📝
• -p PID — Only traces this process ID, and the filtering happens in-kernel 🎯

🍓 EXAMPLES 🍓

Trace all short-lived files and print the details:

# filelife

Trace all short-lived files created AND deleted by PID 181:

# filelife -p 181

🦋 FIELDS 🦋

• TIME — When the deletion happened ⏰
• PID — The process ID that deleted the file 🪪
• COMM — The process name for that PID 🏷️
• AGE(s) — How old the file was, from creation to deletion, in seconds ⏳
• FILE — The filename 📄

🌈 OVERHEAD 🌈

This traces the kernel VFS file create and delete functions and prints output for each delete. The rate is usually expected to be low (< 1000/s), so the overhead should be negligible 😌 This is from bcc.

Check out the project here: https://github.com/iovisor/bcc

Also, look in the bcc distribution for a companion _examples.txt file. It has example usage, output, and commentary for this tool 📚

💻 OS 💻

Linux only 🐧

🧪 STABILITY 🧪

Unstable - it's still in development 🚧

👑 AUTHOR 👑

Brendan Gregg 🫶

🔗 SEE ALSO 🔗

• opensnoop(1) 👀

---

Okay bestie, that's the whole filelife page 💅 It's the manual for the filelife tool, from the USER COMMANDS section, dated 2016-02-08 🎀 Go trace some short-lived files and slay the debugging game 💖🌸