libbpf-tools: add BPF CO-RE filegone

iovisor / bcc

BCC - Tools for BPF-based Linux IO analysis, networking, monitoring, and more

Apache License 2.0

20.36k stars 3.86k forks source link

libbpf-tools: add BPF CO-RE filegone #4978

Open kerennaomidev opened 5 months ago

kerennaomidev commented 5 months ago

This is a CO-RE port of the filegone BCC Python tool. The code is inspired by the 'filelife' port.

$ cd libbpf-tools/
$ make filegone 
$ sudo ./filegone 
TIME     PID     COMM         ACTION FILE
16:44:07 172531  mv           RENAME testfile > testfile2
16:44:10 172687  rm           DELETE testfile2

Supports [-p PID] filter option.

Please let us know if any changes are required.