---
name: "filelife-bpfcc"
section: "8"
platform: "linux"
package: "bpfcc-tools"
version: "0.31.0+ds-7"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/filelife-bpfcc"
---

# filelife-bpfcc(8)

Trace the lifespan of short-lived files. Uses Linux eBPF/bcc.

## NAME

filelife - Trace the lifespan of short-lived files. Uses Linux eBPF/bcc.

## SYNOPSIS

**filelife \[-h\] \[-p PID\]**

## DESCRIPTION

This traces the creation and deletion of files, providing information on who deleted the file, the file age, and the file name. The intent is to provide information on short-lived files, for debugging or performance analysis.

This works by tracing the kernel vfs\_create() and vfs\_delete() functions (and maybe more, see the source) using dynamic tracing, and will need updating to match any changes to these functions.

This makes use of a Linux 4.4 feature (bpf\_perf\_event\_output()); for kernels older than 4.4, see the version under tools/old, which uses an older mechanism.

Since this uses BPF, only the root user can use this tool.

## REQUIREMENTS

CONFIG\_BPF and bcc.

## OPTIONS

- \-h

  Print usage message.

- \-p PID

  Trace this process ID only (filtered in-kernel).

## EXAMPLES

- Trace all short-lived files, and print details:

  \# **filelife**

- Trace all short-lived files created AND deleted by PID 181:

  \# **filelife -p 181**

## FIELDS

- TIME

  Time of the deletion.

- PID

  Process ID that deleted the file.

- COMM

  Process name for the PID.

- AGE(s)

  Age of the file, from creation to deletion, in seconds.

- FILE

  Filename.

## OVERHEAD

This traces the kernel VFS file create and delete functions and prints output for each delete. As the rate of this is generally expected to be low (\< 1000/s), the overhead is also expected to be negligible. This is from bcc.

-

  https://github.com/iovisor/bcc

Also look in the bcc distribution for a companion \_examples.txt file containing example usage, output, and commentary for this tool.

## OS

Linux

## STABILITY

Unstable - in development.

## AUTHOR

Brendan Gregg

## SEE ALSO

opensnoop(1)