Monitoring FS operations

[Kevin Strong]

Jérôme Petazzoni wrote:
>>Without going into the specific reasons why I need to do so, is anyone
>>aware of a method (or tool) of watching real-time, human-readable (or
>>system call print) of ext3 filesystem operations on a mounted, active
>>filesystem?
> 
> 
> Look for the lm-profiler tool in the "laptop-mode" tools. It does
> (almost) that :
> 
> modprobe(18534): dirtied inode 457921 (irda-utils) on sda2
> modprobe(18534): dirtied inode 457920 (bluez) on sda2
> modprobe(18534): dirtied inode 49330 (display_class) on sda2
> modprobe(18534): dirtied inode 461377 (zaptel) on sda2
> modprobe(18534): dirtied inode 58905 (blacklist) on sda2
> modprobe(18534): dirtied inode 180040 (blacklist.d) on sda2
> modprobe(18534): dirtied inode 1046702 (modules.dep) on sda2
> dmesg(18537): dirtied inode 1030298 (dmesg_next) on sda2
> dmesg(18572): dirtied inode 1030322 (dmesg_next) on sda2
> dmesg(18597): dirtied inode 1030298 (dmesg_next) on sda2
> dmesg(18624): dirtied inode 1030322 (dmesg_next) on sda2
> modprobe(18650): dirtied inode 1046617 (modules.alias) on sda2
> dmesg(18653): dirtied inode 1030298 (dmesg_next) on sda2
> dmesg(18682): dirtied inode 1030322 (dmesg_next) on sda2
> dmesg(18711): dirtied inode 1030298 (dmesg_next) on sda2
> dmesg(18740): dirtied inode 1030322 (dmesg_next) on sda2
> nmbd(4821): dirtied inode 572609 (browse.dat.) on sda2
> nmbd(4821): dirtied inode 573668 (?) on sda2
> pdflush(164): WRITE block 7177944 on sda2
> pdflush(164): WRITE block 20070920 on sda2
> pdflush(164): WRITE block 16035888 on sda2
> pdflush(164): WRITE block 16035896 on sda2
> lm-profiler(18769): dirtied inode 33606 (dmesg) on sda2
> dmesg(18769): dirtied inode 964795 (locale-archive) on sda2
> dmesg(18769): dirtied inode 1030298 (dmesg_next) on sda2
> lm-profiler(18772): dirtied inode 360165 (diff) on sda2
> 
> That may or may not be what you want, however !
> 
> regards

Thanks.  That's a good start.  Not what I was after but I'll see what it 
gives me on my box.  I'm looking for something like "Filemon" from 
sysinternals.com (for Windows) - something that shows every operation 
sent to the FS driver.

Thanks again.

Kevin Strong
Criminal Information Network