opensnoop.bt(8)

✨ opensnoop.bt — the manual, but make it make sense ✨

okay so real talk, this is a page from the System Manager's Manual (the opensnoop.bt(8) one, iykyk) and it's literally about watching every single file your system tries to open. no cap, it's a whole vibe.

---

💅 NAME

opensnoop.bt — traces the open(), openat(), openat2() syscalls. and it does it with bpftrace/eBPF, which is the cool part. periodt.

---

🎀 SYNOPSIS

opensnoop.bt -- [--depth=<N>] [--errname]

that's it bestie. that's the whole command. so clean.

---

🌸 DESCRIPTION

opensnoop traces the open(), openat(), openat2() syscall, and it shows you which processes are trying to open which files. which is genuinely so useful — like, you wanna know where an app's config files and log files actually live? boom, this tells you. you got an application that's failing, especially like right at startup and you're sitting there like "why 😭"? also this. it's giving detective energy ngl.

the way it works: it traces the open(), openat(), openat2() syscall tracepoint. that's the whole mechanism, nothing secret happening.

⚠️ since this uses BPF, only the root user can use this tool. no root, no snooping. fr fr.

---

🦋 OPTIONS

• --depth=<N> — sets the max supported path depth you want to track. the default is 35, so if your paths are getting real deep and dramatic, this is your girl 💅
• --errname — shows you the actual error message instead of the raw errno. so much friendlier honestly 🥺

---

💜 REQUIREMENTS

• CONFIG_BPF
• bcc

that's the checklist. both of them. don't skip.

---

🔥 EXAMPLES

trace all the open(), openat(), openat2() syscalls — like, all of them:

# opensnoop.bt

ok and that # at the front? that's your root reminder. slay.

---

⭐ FIELDS

this is what each column means, so you're not squinting at the output like 👁️👄👁️

• PID — Process ID
• COMM — Process name
• FD — File descriptor, if it succeeded (or -1 if it failed 💀)
• ERR — Error number (go look at the system's errno.h if you want the lore)
• PATH — Open path

---

🌈 OVERHEAD

so this thing traces the open tracepoint and prints output for each and every event. and because the rate of that is generally expected to be low (< 1000/s), the overhead is also expected to be like, negligible. tiny. barely a blip. 🧚

but — if you have an application that's calling a high rate of open()s, then test it and understand the overhead before you use it. that's an actual warning, not a suggestion 🙈

---

👑 SOURCE

this is from bpftrace.

https://github.com/bpftrace/bpftrace

also! go look in the bpftrace distribution for a companion _examples.txt file — it's got example usage, output, and commentary for this tool. the whole package. 💖

one more thing: this is a bpftrace version of the bcc tool of the same name. the bcc tool may provide more options and customizations, so if you want the extra toppings, that's where they are.

https://github.com/iovisor/bcc

---

🍓 OS

Linux. obviously. 😌

---

💀 STABILITY

Unstable — in development. she's still growing, be nice to her 🫶

---

🎀 AUTHORS

Brendan Gregg, Rong Tao <rongtao@cestc.cn>

---

🌟 SEE ALSO

statsnoop.bt(8), execsnoop.bt(8)

go read those too, they're the friend group 💅✨

---

and that's the whole page bestie — brought to you by USER COMMANDS, dated 2018-09-08, mwah 💋