0

Is it possible to watch external process by its pids for read/write events? In particular I want to write a program which counts bytes an external process has written to stdout, stderr or FILE*. Desired platform is Linux. Note: I cannot change source code of target processes.

arminb
  • 2,036
  • 3
  • 24
  • 43
  • If you don't want to write your own kernel module, just make a simple shell that will intercept file operations, or make an dynamic library that would substitute some stdlib calls and call external process with LD_PRELOAD=your_lib.so. – Eddy_Em Dec 18 '14 at 13:57
  • How do I intercept file operations by shell? – arminb Dec 18 '14 at 14:01

1 Answers1

0

To see each write as it occurs:

strace -ewrite -p$PID

To see a sum of bytes written when the process ends:

strace -ewrite -p$PID 2>&1 | { while read; do set $REPLY; n=$_; [ $n -gt 0 ] && let count+=$n; done; echo $count; }

The above assume that process $PID already runs; note that only writes after strace started are counted. To account from the start of $PROCESS, start it with strace -ewrite $PROCESS instead.

Armali
  • 18,255
  • 14
  • 57
  • 171