filetrace agent runs or controls the background agent from the command-line interface. run collects in the foreground and serves queries, like filetrace-agent; status reports whether an agent is serving the socket; stop asks the running agent to stop.
Usage
run
agent run starts the agent in the foreground: it loads the probes, collects and answers the other commands on the socket until you press Ctrl-C. It runs the same code as filetrace-agent and takes the same options. The global options --socket and --config given before agent, and $FILETRACE_SOCKET, are passed on to it.
filetrace-agent directly. Run the agent as a service shows how.
status
agent status reports whether an agent is serving the socket, with its backend, mode, PID, start time, uptime and health:
Degraded while the agent has lost events within the last 60 seconds; stats gives the details. When no agent is running, status prints Monitoring: STOPPED with the command that starts one. Because the exit code carries the answer, status suits scripts and health checks:
stop
agent stop asks the running agent to stop. It prints The agent is stopping. and returns; the agent closes its socket and removes it as it exits.
Options
status and stop take no options. The options of run:
string
default:"standard"
minimal or standard. Minimal collects processes, sockets and network byte counts; standard adds file identity and file-to-network attribution.string
default:"auto"
auto, trampoline or kprobe. Auto uses BPF trampolines where the kernel has them and kprobes otherwise.string
default:"250ms"
How often counters are collected from the kernel.
string
default:"4MB"
Kernel event queue size. The default is 1MB in minimal mode.
string
default:"2s"
Longest read-to-send gap that still associates a file with a send.
string
default:"info"
error, warn, info or debug.agent run also accepts --event-log-size and the other options of filetrace-agent, which lists their accepted ranges, and filetrace agent run --help prints the agent’s own help.