---
name: "opensnoop"
section: "8"
platform: "linux"
package: "perf-tools-unstable"
version: "0.0.1~20140723+git942be0b-4"
release: "Debian 8 (Jessie)"
platforms: ["linux"]
url: "https://new.carta.tech/opensnoop/8"
---

# opensnoop(8)

trace open() syscalls with file details. Uses Linux ftrace.

## NAME

opensnoop - trace open() syscalls with file details. Uses Linux ftrace.

## SYNOPSIS

**opensnoop** \[-htx\] \[-d secs\] \[-f file\] \[-p pid\] \[-n name\]

## DESCRIPTION

This traces open() syscalls, showing the file name (pathname) and returned file descriptor number (or -1, for error).

This implementation is designed to work on older kernel versions, and without kernel debuginfo. It works by dynamic tracing of the return value of getname() as a string, and associating it with the following open() syscall return. This approach is kernel version specific, and may not work on your version. It is a workaround, and proof of concept for ftrace, until more kernel tracing functionality is available.

Since this uses ftrace, only the root user can use this tool.

## REQUIREMENTS

FTRACE and KPROBE CONFIG, the syscalls:sys\_exit\_open tracepoint, and the getname() kernel function. You may already have these enabled and available on recent Linux kernels. And awk.

## OPTIONS

- \-d secs

  Set the duration of tracing, in seconds. Trace output will be buffered and printed at the end. This also reduces overheads by buffering in-kernel, instead of printing events as they occur.

  The ftrace buffer has a fixed size per-CPU (see /sys/kernel/debug/tracing/buffer\_size\_kb). If you think events are missing, try increasing that size.

- \-f file

  Only show open()s which match this filename. Partial strings and regular expressions are allowed. This is post-filtered using awk.

- \-h

  Print usage message.

- \-n name

  Only show processes matching this process name. Partial strings and regular expressions are allowed. This is post-filtered using awk.

- \-p PID

  Only trace this process ID. This is filtered in-kernel.

- \-t

  Include timestamps, in seconds.

- \-x

  Only print failed open()s.

## EXAMPLES

- Trace all open() syscalls with details:

  **opensnoop**

- Only trace open()s for PID 81:

  **opensnoop -p 81**

- Trace failed open() syscalls:

  **opensnoop -x**

- Trace open() syscalls for filenames containing "log":

  **opensnoop -f log**

## FIELDS

- TIMEs

  Time of open() completion, in units of seconds.

- COMM

  Process name (if known).

- PID

  Process ID.

- FD

  File descriptor. If this is a successful open, the file descriptor number is shown. If this is unsuccessful, -1 is shown. Numbers beginning with 0x are hexadecimal.

- FILE

  Filename (pathname) used by the open() syscall.

## OVERHEAD

This reads and open() syscalls and getname() kernel functions as they occur. For high rates of opens (\> 500/s), the overhead may begin to be measurable. Test yourself. You can use the -d mode to buffer output, reducing overheads.

## SOURCE

This is from the perf-tools collection.

-

  https://github.com/brendangregg/perf-tools

Also look under the examples directory for a text file containing example usage, output, and commentary for this tool.

## OS

Linux

## STABILITY

Unstable - in development.

## AUTHOR

Brendan Gregg

## SEE ALSO

[execsnoop(8)](/execsnoop/8.md), [strace(1)](/strace/1.md)