Trace operations on a particular file/device?

[Roland McGrath]

No, there is no way that strace can do that for you.  Its filtering options
are fairly primitive to begin with.  I think the best you can really do is
"-e file" or to choose a specific set of syscalls to trace.  Then you will
have less volume to filter out than tracing every single system call.  But
there are no options based on the specific syscall arguments or anything
even more sophisticated than that.

Based on the fundamental mechanisms that strace uses, it really can't do
what you are looking for.  It just doesn't know anything about the level of
distinction you want to make.  The system call arguments are all it has.
For most i/o-related calls that you are probably looking for, there is
nothing distinctive in the arguments except for an integer that is a file
descriptor.  It has no way to know what file or device that descriptor
refers to.  A really fancy post-processing could look at previous calls to
open/dup/etc and keep track for each file descriptor seen what past calls
were involved in creating it, and surmise the association with a file from
that.  We don't have anything like that at all.  Even if we did, it still
can't tell about file descriptors received by inheritance or SCM_RIGHTS or
whatever, where strace didn't trace the creation.  In Linux, it's possible
to deduce some information about descriptors by looking at the
/proc/PID/fd/FD symlink target.  strace doesn't do anything like that.

When what you are interested in doing is more intelligent filtering at the
time of each call to avoid producing voluminous traces, then you may do
better with a completely different tool, such as Systemtap (search for it).


Thanks,
Roland