1Demonstrations of filelife, the Linux eBPF/bcc version. 2 3 4filelife traces short-lived files: those that have been created and then 5deleted while tracing. For example: 6 7# ./filelife 8TIME PID COMM AGE(s) FILE 905:57:59 8556 gcc 0.04 ccCB5EDe.s 1005:57:59 8560 rm 0.02 .entry_64.o.d 1105:57:59 8563 gcc 0.02 cc5UFHXf.s 1205:57:59 8567 rm 0.01 .thunk_64.o.d 1305:57:59 8578 rm 0.02 .syscall_64.o.d 1405:58:00 8589 rm 0.03 .common.o.d 1505:58:00 8596 rm 0.01 .8592.tmp 1605:58:00 8601 rm 0.01 .8597.tmp 1705:58:00 8606 rm 0.01 .8602.tmp 1805:58:00 8639 rm 0.02 .vma.o.d 1905:58:00 8650 rm 0.02 .vdso32-setup.o.d 2005:58:00 8656 rm 0.00 .vdso.lds.d 2105:58:00 8659 gcc 0.01 ccveeJAz.s 2205:58:00 8663 rm 0.01 .vdso-note.o.d 2305:58:00 8674 rm 0.02 .vclock_gettime.o.d 2405:58:01 8684 rm 0.01 .vgetcpu.o.d 2505:58:01 8690 collect2 0.00 ccvKMxdm.ld 26 27This has caught short-lived files that were created during a Linux kernel 28build. The PID shows the process ID that finally deleted the file, and COMM 29is its process name. The AGE(s) column shows the age of the file, in seconds, 30when it was deleted. These are all short-lived, and existed for less than 31one tenth of a second. 32 33Creating, populating, and then deleting files as part of another process can 34be an inefficient method of inter-process communication. It can cause disk I/O 35as files are closed and their file descriptors flushed, only later to be 36deleted. As such, short-lived files can be a target of performance 37optimizations. 38 39USAGE message: 40 41# ./filelife -h 42usage: filelife [-h] [-p PID] 43 44Trace stat() syscalls 45 46optional arguments: 47 -h, --help show this help message and exit 48 -p PID, --pid PID trace this PID only 49 50examples: 51 ./filelife # trace all stat() syscalls 52 ./filelife -p 181 # only trace PID 181 53