filelife(8) System Manager's Manual filelife(8)

# [NAME](#NAME)

filelife - Trace the lifespan of short-lived files. Uses Linux eBPF/bcc.

# [SYNOPSIS](#SYNOPSIS)

**filelife \[-h] \[-p PID]**

# [DESCRIPTION](#DESCRIPTION)

This traces the creation and deletion of files, providing information on who deleted the file, the file age, and the file name. The intent is to provide information on short-lived files, for debugging or performance analysis.

This works by tracing the kernel vfs\_create() and vfs\_delete() functions (and maybe more, see the source) using dynamic tracing, and will need updating to match any changes to these functions.

This makes use of a Linux 4.4 feature (bpf\_perf\_event\_output()); for kernels older than 4.4, see the version under tools/old, which uses an older mechanism.

Since this uses BPF, only the root user can use this tool.

# [REQUIREMENTS](#REQUIREMENTS)

CONFIG\_BPF and bcc.

# [OPTIONS](#OPTIONS)

[-h](#h)

Print usage message.

[-p PID](#p)

Trace this process ID only (filtered in-kernel).

# [EXAMPLES](#EXAMPLES)

[Trace all short-lived files, and print details:](#Trace)

\# **filelife**

[Trace all short-lived files created AND deleted by PID 181:](#Trace~2)

\# **filelife -p 181**

# [FIELDS](#FIELDS)

[TIME](#TIME)

Time of the deletion.

[PID](#PID)

Process ID that deleted the file.

[COMM](#COMM)

Process name for the PID.

[AGE(s)](#AGE%28s%29)

Age of the file, from creation to deletion, in seconds.

[FILE](#FILE)

Filename.

# [OVERHEAD](#OVERHEAD)

This traces the kernel VFS file create and delete functions and prints output for each delete. As the rate of this is generally expected to be low (< 1000/s), the overhead is also expected to be negligible. This is from bcc.

https://github.com/iovisor/bcc

Also look in the bcc distribution for a companion \_examples.txt file containing example usage, output, and commentary for this tool.

# [OS](#OS)

Linux

# [STABILITY](#STABILITY)

Unstable - in development.

# [AUTHOR](#AUTHOR)

Brendan Gregg

# [SEE ALSO](#SEE_ALSO)

[opensnoop(1)](/man/enterprise-packages/bcc/opensnoop.1)

2016-02-08 USER COMMANDS

---

Document: filelife(8) from bcc 0.37.0-r3 (Chainguard OS)
Source: https://github.com/iovisor/bcc