Watching what an app does?

[littlebigman]

Hello

There's a proprietary application that I need that is packaged within a live ISO based on Ubuntu 9.10, so I'd like to try and transplant it into a Ubuntu 10.04 ISO and add/remove applications and drivers.

I have no idea if it's going to work, but in any case, I need an application that I would launch before running the proprietary app, point it to the main binary of that proprietary application, and expect to see all the locations/files it uses so that I can see what directories and files it expects to find.

Does any Linux application do this?

Thank you.

[Irithori]

strace -o <outfile> <proprietary_app>

Will provide you with all the systemcalls, that this app uses.
It might get a bit tricky, if the app should fork or use threads,
but it´s a start.

[Kloschüssel]

try lsof. that shows you all open handles for a running process.

[littlebigman]

Thanks for the tips. After trying strace, I'll check if lsof can save everything in a log file so that I can see what calls the application made to the filesystem during a session.

[Kloschüssel]

lsof lists the files opened at a specific moment. as far i know it can't monitor things precisely. lsof is targeted for system administrators / developers that for example need to fix a software that ran into a deadlock and want to release file locks that are kept open or got a process doing weird things on the filesystem or the network.

[littlebigman]

Yes, that's what I suspected :-/ I'm surprised there's no equivalent in Linux to Sysinternals' Process monitor to monitor what an application does to the filesystem.