Process tool

Linux and Unix-Like Red Hat
1

Hi

Do you know a tool for redhat/unix, that receives process ID, and provides list of all files that were changed by this process?

Thanks
Guy

2

Unless you have auditing enabled -BEFORE - you need this information, for a long running process this is impossible. Once a file is changed the only evidence of the change is that changed data itself, there is no place that says PID 1234 changed file blah line 26.

Without auditing.
The only exception: attach to the process with a debugger and sit there at the console and manually monitor the process as it changes files, real time. Which I do not think is what you asked.

That is a decent answer.
Now, please, tell us: what problem are you trying to solve? NOT how you think it can be done.

3

thanks a lot for taking the time to answer me.
i dont know currently what is the problem, i got this question from our R&D team and wanted to get a clue