Tracing File System Accesses

The CernVM-FS Fuse client comes with a built-in tracer that can be used to record file system accesses to repositories. The tracer produces a CSV file. Every file system call, such as opening a file or listing a directory, is written as another line into the log file.

In order to activate the tracer, set

CVMFS_TRACEFILE=/tmp/cvmfs-trace-@fqrn@.log  # the cvmfs user must have write permission to the target directory

The @fqrn@ syntax ensures that the trace file is different for every repository.

The trace is internally buffered. Therefore, it is important to either unmount the CernVM-FS client or to call cvmfs_talk tracebuffer flush at the end of a tracing session in order to produce a complete record.

By default, the trace buffer can keep 8192 recorded calls, and it will start to flush on disk at 7000 recorded system calls. The buffer parameters can be adjusted with the two parameters CVMFS_TRACEBUFFER and CVMFS_TRACEBUFFER_THRESHOLD.

Trace Log Format

The generated trace log is a CSV file with the following fields

Field

Description

Timestamp

Seconds since the UNIX epoch, miliseconds precision

Event code

Numerical ID for the system call. Negative numbers indicate internal events, such as mounting and unmounting.

Path

The repository relative target path of the system call

Event name

A string literal corresponding to the event code.

The following events are known:

Event ID

Description

1

Open file

2

List directory contents

3

Read symbolic link

4

Lookup path

5

Get file system meta-data (e.g. df call)

6

Get file/directory meta-data

7

List extended attributes of a file/directory

8

Read extended attributes of a file/directory