fsnoop 文件系统事件观察器

fsnoop fsnoop窥探你的文件不带参数自行运行，fsnoop将报告当前目录中的所有文件修改事件。这是从/tmp/snoop运行的示例会话。以#开头的行在单独的shell中运行： # ls open /tmp/snoop close-nowrite /tmp/snoop # touch test create /tmp/snoop/test open /tmp/snoop/test attrib /tmp/snoop/test close-write /tmp/snoop/test # echo hi > test modify /tmp/snoop/test open /tmp/snoop/test modify /tmp/snoop/test close /tmp/snoop/te