1*387f9dfdSAndroid Build Coastguard WorkerDemonstrations of filegone, the Linux eBPF/bcc version. 2*387f9dfdSAndroid Build Coastguard Worker 3*387f9dfdSAndroid Build Coastguard Worker 4*387f9dfdSAndroid Build Coastguard Workerfilegone traces why file gone, either been deleted or renamed 5*387f9dfdSAndroid Build Coastguard WorkerFor example: 6*387f9dfdSAndroid Build Coastguard Worker 7*387f9dfdSAndroid Build Coastguard Worker# ./filegone 8*387f9dfdSAndroid Build Coastguard Worker18:30:56 22905 vim DELETE .fstab.swpx 9*387f9dfdSAndroid Build Coastguard Worker18:30:56 22905 vim DELETE .fstab.swp 10*387f9dfdSAndroid Build Coastguard Worker18:31:00 22905 vim DELETE .viminfo 11*387f9dfdSAndroid Build Coastguard Worker18:31:00 22905 vim RENAME .viminfo.tmp > .viminfo 12*387f9dfdSAndroid Build Coastguard Worker18:31:00 22905 vim DELETE .fstab.swp 13*387f9dfdSAndroid Build Coastguard Worker 14*387f9dfdSAndroid Build Coastguard WorkerUSAGE message: 15*387f9dfdSAndroid Build Coastguard Worker 16*387f9dfdSAndroid Build Coastguard Workerusage: filegone.py [-h] [-p PID] 17*387f9dfdSAndroid Build Coastguard Worker 18*387f9dfdSAndroid Build Coastguard WorkerTrace why file gone (deleted or renamed) 19*387f9dfdSAndroid Build Coastguard Worker 20*387f9dfdSAndroid Build Coastguard Workeroptional arguments: 21*387f9dfdSAndroid Build Coastguard Worker -h, --help show this help message and exit 22*387f9dfdSAndroid Build Coastguard Worker -p PID, --pid PID trace this PID only 23*387f9dfdSAndroid Build Coastguard Worker 24*387f9dfdSAndroid Build Coastguard Workerexamples: 25*387f9dfdSAndroid Build Coastguard Worker ./filegone # trace all file gone events 26*387f9dfdSAndroid Build Coastguard Worker ./filegone -p 181 # only trace PID 181 27