You could also try using strace as well, although maybe I just don't understand exactly what you need. Note; if the script doesn't run long enough it's hard to catch the data. For example when I ran dd below with a count of 1000 both text files were empty. I ran this as myself and root, the results were as expected. #crontab.txt * * * * * dd if=/dev/zero of=openfile bs=8k count=10000 * * * * * fuser openfile > fuser.txt * * * * * lsof | grep openfile > lsof.txt cat fuser.txt 2659 cat lsof.txt dd 2659 $USER 1w REG 8,2 59416576 1060541 /home/$USER/openfile On Tue, Mar 1, 2011 at 6:43 PM, Kurt Granroth < kurt+plug-discuss@granroth.com> wrote: > I tried a script using incron last night and it implied that it was > happening exactly when SpiderOak was starting up. I say "implied" because > it effectively fork-bombed me (lesson learned: don't use IN_ALL_EVENTS) and > my log file was all corrupted when I had to reboot. > > On 3/1/11 9:19 AM, Dazed_75 wrote: > >> Given that you said "... corrupting or rewriting a critical file _just >> before_ it runs", would it be worth renaming, removing or changing >> permissions on the file just before that to see what fails or logs an >> error? >> >> Larry >> >> On Tue, Mar 1, 2011 at 8:14 AM, Alex Dean > > wrote: >> >> >> On Feb 28, 2011, at 5:33 PM, Kurt Granroth wrote: >> >> > Maybe incron (cron version of inotify) could trigger a script >> that runs 'stat' on the file. Still wouldn't give me the "who", >> though. >> >> At first glance, I thought inotify would be perfect for this. But >> (as you say) it doesn't appear that inotify events contain any >> information about which process performed the change which trigged >> the event. >> >> struct inotify_event { >> __s32 wd; /* watch descriptor */ >> __u32 mask; /* watch mask */ >> __u32 cookie; /* cookie to synchronize two events */ >> __u32 len; /* length (including nulls) of name */ >> char name[0]; /* stub for possible name */ >> }; >> http://www.linuxjournal.com/article/8478?page=0,1 >> >> There are some handy-looking tools in >> https://github.com/rvoicilas/inotify-tools/wiki/. Seems like you >> should be able to write a shell script to wait for a modification >> event on your file, and run stat or lsof when the file is changed. >> That's not perfect, since the modifying process might be done by >> the time lsof actually runs, but it seems like it's worth a try. >> >> alex >> --------------------------------------------------- >> PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us >> >> To subscribe, unsubscribe, or to change your mail settings: >> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss >> >> >> >> >> -- >> Dazed_75 a.k.a. Larry >> >> The spirit of resistance to government is so valuable on certain >> occasions, that I wish it always to be kept alive. >> - Thomas Jefferson >> >> >> >> --------------------------------------------------- >> PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us >> To subscribe, unsubscribe, or to change your mail settings: >> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss >> > > --------------------------------------------------- > PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us > To subscribe, unsubscribe, or to change your mail settings: > http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss >