- Prev
- SystemTap Beginners Guide
- Next

### ⁠5.2.5. Monitoring Reads and Writes to a File

This section describes how to monitor reads from and writes to a file in real time.
inodewatch.stp

    #! /usr/bin/env stap

    probe vfs.{write,read}
    {
      # dev and ino are defined by vfs.write and vfs.read
      if (dev == MKDEV($1,$2) # major/minor device
          && ino == $3)
        printf ("%s(%d) %s 0x%x/%u\n",
          execname(), pid(), ppfunc(), dev, ino)
    }

inodewatch.stp takes the following information about the file as arguments on the command line:

- The file's major device number.
- The file's minor device number.
- The file's `inode` number.

To get this information, use `stat -c '%D %i' filename`, where `filename` is an absolute path.
For instance: to monitor `/etc/crontab`, run `stat -c '%D %i' /etc/crontab` first. This gives the following output:

    805 1078319

`805` is the base-16 (hexadecimal) device number. The lower two digits are the minor device number and the upper digits are the major number. `1078319` is the `inode` number. To start monitoring `/etc/crontab`, run `stap inodewatch.stp 0x8 0x05 1078319` (The `0x` prefixes indicate base-16 values.
The output of this command contains the name and ID of any process performing a read/write, the function it is performing (that is, `vfs_read` or `vfs_write`), the device number (in hex format), and the `inode` number. Example 5.10, “inodewatch.stp Sample Output” contains the output of `stap inodewatch.stp 0x8 0x05 1078319` (when `cat /etc/crontab` is executed while the script is running) :
⁠

Example 5.10. inodewatch.stp Sample Output

    cat(16437) vfs_read 0x800005/1078319
    cat(16437) vfs_read 0x800005/1078319

- Prev5.2.4. I/O Monitoring (By Device)
- Up
- Home
- Next5.2.6. Monitoring Changes to File Attributes