Introduction

Filemon is an application that monitors and displays all file system activity on a system. It has advanced filtering and search capabilities that make it a powerful tool for exploring the way Linux works, seeing how applications use the files and shared libraries, or tracking down problems in system or application configurations.

Filemon works on Linux 2.4 (at the current time its unknown if it works on 2.2 kernels). Visit Sysinternals for a version of Filemon that runs on Windows operating systems.

Starting Filemon

Make sure that the Kylix runtime libraries libqtintf.so and libqt.so.2, downloadable below, are on your LD_LIBRARY_PATH. I recommend you install the files to /root/kylix/bin, their standard home in a Kylix installation. If you're using the BASH shell you can set the library path either in your shell initialization file (typically .bash_profile), or you can set it interactively like this:

export LD_LIBRARY_PATH=/root/kylix/bin

Then you can run Filemon from the directory in which its located by typing:

./filemon

Filemon requires root privileges to run.

When Filemon is started for the first time it will monitor all file system activity. Menus, hot-keys, or toolbar buttons can be used to clear the window, save the monitored data to a file, and to filter and search output. As events are printed to the output, they are tagged with a sequence number. If Filemon's internal buffers are overflowed during extremely heavy activity, this will be reflected with gaps in the sequence number.

Each time you exit Filemon it remembers the position of the window and the widths of the output columns.

Filtering Output

Use the Filter dialog, which is accessed with a toolbar button or the Edit|Filter/Highlight menu selection, to select what data will be shown in the list view. Filters are case-insensitive. Only matches shown in the include filter, but that are not excluded with the exclude filter, are displayed. Use ';' to separate multiple strings in a filter (e.g. "filemon;temp"). Note: because of the asynchronous nature of most file I/O, filtering on the result field is not possible.

For example, if the include filter is "temp", and the exclude filter is "temp/subdir", all references to files and directories under /temp, except to those under /temp/subdir will be monitored.

Use the highlight filter specify output that you want to have highlighted in the listview output. Select highlighting colors with Edit|Highlight Colors.

Limiting Output

The History Depth dialog, accessed via toolbar button or the Edit|History Depth menu item, allows you to specify the maximum number of lines that will be remembered in the output window. A depth of 0 is used to signify no limit.

Searching the Output

You can search the output window for strings using the Find menu item (or the find toolbar button). Once you have opened a Find dialog and hit the FindNext button, you can repeat the search without changing the focus back to the Find dialog by hitting the F3 key.

To start a search at a particular line in the output, select the desired line by clicking on the far left column (the index number). If no line is selected a new search starts at the first entry in searching down, and at the last entry for searching up.

Options

Filemon can either timestamp events or show their duration. The Options menu and the clock toolbar button let you toggle between the two modes. The button on the toolbar shows the current mode with a clock or a stopwatch. When showing duration the Time field in the output shows the number of seconds it took for the underlying file system to service particular requests.

You can toggle Filemon not to scroll the listview via the Options|Auto Scroll menu item or corresponding toolbar button.

Font Selection

Use the Edit|Font menu item to change the font used in the listview.

Reporting Bugs and Feedback

If you encounter a problem while running Filemon, please visit www.sysinternals.com to obtain the latest version. If you still have problems, determine if the problem is reproducible, and if so, how, and send this information to:

mark@sysinternals.com

Licensing

If you want to license Filemon for redistribution, or license Filemon source code, please contact licensing@sysinternals.com.