FNOTIFYSTAT(8)

💖 fnotifystat(8) — bestie's guide to watching your filesystem do stuff 💖

okay so real talk, this is fnotifystat from the System Manager's Manual section 8, and it's literally the tool you want when you're like "what is my filesystem even doing right now" 🦋

---

✨ NAME ✨

fnotifystat — a tool to show file system activity. that's it, that's the whole vibe. no cap.

---

🌸 SYNOPSIS 🌸

fnotifystat [options] [delay [count]]

---

🎀 DESCRIPTION 🎀

so fnotifystat is a program that dumps the file system activity in a given period of time. like, it just tells you what's being opened, closed, read and written, and by whom. main character energy fr fr.

Statistics are output every delay seconds. and bestie, if you need a big delay, you can slap a suffix on it: m (minutes), h (hours), d (days), w (weeks) or y (years). By default the delay is 1 second. periodt.

Statistics are output count many times before exiting. If count is not specified then fnotifystat will run until it is stopped. it's giving "I will never leave you" 😭

heads up 💀 if no file activity has occurred during a sample delay period then no new statistics are output. so you might just be sitting there staring at nothing. the -f option will force output if desired. use it. love it.

By default, fnotifystat will display the following statistics every sample delay seconds:

• Average number of opens, closes, reads and writes over the sample period
• Average number of opens over the sample period
• Average number of closes over the sample period
• Average number of reads over the sample period
• Average number of writes over the sample period
• Process ID
• Pathname

The -I option will display the device (major, minor) number and inode instead of the filename while the -I option will just show the device (major, minor) number. 🙈 (yes, that's what it says, I'm just the messenger)

The -c option will display the cumulative count of the open, close, read and writes rather than the averages.

---

💅 OPTIONS 💅

fnotifystat options are as follow:

• -c — dump cumulative totals over all time rather than totals over each sample period.
• -d — strip full directory path off the filenames.
• -f — force statistics output even if no file activity has occurred during the last sampling period.
• -D — order statistics by unique device. Rather than ordering periodic statistics by unique filename, instead order them by unique device (major, minor) number. This allows one to see file activity on a per device basis.
• -h — show help
• -i — pathnames to include in filename activity. By default, all mounted filesystems are monitored, however, this may produce to much information. The -i option allows one to provide a comma separated list of just the specific paths to monitor.
• -I — order statistics by unique device and inode. Rather than ordering periodic statistics by unique filename, instead order them by unique device (major, minor) and inode number.
• -m — merge events. The default -v verbose output will show all new events that fnotifystat detects on a file by a specific process. The -m option will merge all consecutive events that occur on the same file from the same process to reduce the amount of event output. less spam, more slay ✨
• -n — no periodic statistics, just verbose mode only. Do not display periodic file activity statistics, but just show the verbose mode -v file activity.
• -p proclist — monitor specific processes. proclist is a comma separated list of process IDs or process names to monitor.
• -P — sort stats by pid first, then by totals and filename
• -r — sort stats by number of reads first, then by totals and filename
• -s — turn off data scaling. By default the read, write, open and close counts are displayed by scaling by multiple of thousands with suffixes of K (thousands), M (millions), B (billions). The -s option disables this, resulting in less aesthetically pleasing unaligned columns of data. 💀 not the unaligned columns
• -t N — only display the top busiest N files.
• -T — show timestamp
• -v — verbose mode, dump all file activity. This will display the following file access information:
  • Date (in DD/MM/YY format)
  • Time (in HH:MM:SS format)
  • Event count
  • Access type, O=Open, C=Close, R=Read, W=Write
  • Process ID
  • Process Name
  • Name of accessed file

Note that the names of deleted filenames cannot be determined and are flagged by the "(deleted)" tag. 😭 rip little file, we hardly knew ye

• -w — sort stats by number of writes first, then by totals and filename
• -x — pathnames to exclude from filename activity. By default, all mounted filesystems are monitored, however, this may produce to much information. The -x option allows one to provide a comma separated list of pathnames to exclude. Matching is performed on partial pathnames, for example -x /pro will exclude all paths starting with /pro, such as /proc. Note that excluding a file with -x takes higher precedence over including a file with -i. so -x is the main character here, sorry -i 💅
• SIGUSR1 — Sending SIGUSR1 to fnotifystat will toggle the verbose option (-v) on/off. cute little switch, love that for you 🎀

---

🌈 EXAMPLES 🌈

Show file activity every second until stopped.

sudo fnotifystat

Show the top 10 active files every 60 seconds until stopped.

sudo fnotifystat -t 10 60

Show file acivity every 10 seconds just 6 times.

sudo fnotifystat 10 6

Show file activity of thunderbird and process ID 1827.

sudo fnotifystat -p thunderbird,1827

Show every file notify event and the top 20 active activity files over a single period of 5 minutes.

sudo notifystat -v -d -c 5m 1

Just show every file notify event on /sys and /proc and no periodic statisics.

sudo fnotifystat -n -i /sys,/proc

---

👑 AUTHOR 👑

fnotifystat was written by Colin Ian King <colin.i.king@gmail.com>

This manual page was written by Colin Ian King <colin.i.king@gmail.com>, for the Ubuntu project (but may be used by others). iconic behaviour honestly 🫶

---

⭐ COPYRIGHT ⭐

Copyright © 2014-2021 Canonical Ltd, Copyright © 2021-2022 Colin Ian King.

This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. fr fr read that again 💀

---

and that's the whole page bestie — it's the FNOTIFYSTAT(8) manual, dated May 15, 2024, and it lives in the System Manager's Manual. go watch some files, you got this 💖✨🎀