filetrace transfers: transfer records and unattributed bytes

filetrace transfers lists transfer records, most recently active first, with the ID of each. Unlike files, it also lists the bytes a socket sent that no file accounts for, so the rows add up to everything the processes sent.

Usage

filetrace transfers [options]

What it shows

sudo filetrace transfers

ID        PROCESS         FILE                                   REMOTE                BYTES  METHOD      CONFIDENCE
tr_3      file-server     /srv/export/media/files/stream.bin     127.0.0.1:51871     15.5 MB  sendfile    EXACT
tr_s1001  metrics-daemon  unknown                                192.168.65.1:25374    473 B  -           UNKNOWN
tr_se     file-server     unknown                                127.0.0.1:45789     48.8 KB  -           UNKNOWN
tr_sd     file-server     unknown                                127.0.0.1:49084         6 B  -           UNKNOWN
tr_sc     file-server     unknown                                127.0.0.1:40477      195 KB  -           UNKNOWN
tr_2      file-server     /srv/export/media/files/customers.csv  127.0.0.1:52535     11.4 MB  read-write  INFERRED
tr_4      file-server     /srv/export/media/files/backup.tar.gz  [::1]:46399         7.63 MB  sendfile    EXACT
tr_1      file-server     /srv/export/media/files/video.mp4      127.0.0.1:34477     47.7 MB  sendfile    EXACT

Observed since 2026-11-11 20:07:55. History is not kept across agent restarts.

Column	Meaning
ID	The transfer ID
PROCESS	The name of the process that sent the bytes
FILE	The file’s path, or `unknown` for bytes that no file accounts for
REMOTE	The remote address and port of the socket
BYTES	What the socket accepted
METHOD	`sendfile`, `read-write`, or `-` for unattributed bytes
CONFIDENCE	`EXACT`, `INFERRED` or `UNKNOWN`; a `*` after it marks a transfer during which events were lost

A transfer record with a file is one file sent by one process on one socket, and its ID is tr_ followed by a hexadecimal number. A row with FILE unknown holds what one socket sent beyond the bytes attributed to files; its ID is tr_s followed by the socket ID in hexadecimal (tr_s1001 is socket 4097). Both kinds of ID appear as transfer_id in machine-readable output, and --format quiet prints one ID per row. Unattributed rows are left out when a filter can only match files: --path, --path-regex, --min-size, --deleted, --method, and a --confidence other than unknown or all.

Options

boolean

Only files that no longer have a directory entry.

number

Only this process.

string

Only processes with this name. * matches any run of characters. Alias: --name.

string

Only processes of this user, by name or numeric ID.

string

Only processes in this cgroup, by numeric ID or cgroup directory.

number

Only processes in this network, PID or mount namespace, given as the inode number that ls -Li /proc/<pid>/ns shows.

string

Only this file. * matches any run of characters, / included. Alias: --file.

string

Only files whose path matches this POSIX extended regular expression.

string

Only files at least this large, such as 100MB.

string

Only this remote address or CIDR network.

string

Only this local address or CIDR network.

number

Only this local or remote port.

string

default:"all"

Only this protocol: tcp, udp or all.

string

sendfile or read-write. splice, mmap and io_uring are accepted but not observed by this build; with them the command exits with 5 instead of printing an empty list.

string

exact, strong, inferred, unknown or all.

string

At least this many bytes sent, such as 1KB, 100MB or 1GB.

boolean

Only records still in progress: updated within the last 5 seconds.

boolean

Only records that are no longer in progress.

string

Only records active at or after this time: a duration such as 10m, 1h or 7d, or an RFC 3339 timestamp.

string

Only records that started at or before this time.

string

bytes, time, pid, rate, duration, process or file. Without it, the most recently active come first.

boolean

Show remote addresses by host name where a reverse DNS lookup finds one. The lookups tell the DNS resolver which addresses are being looked at.

number

Show at most this many rows.

string

default:"table"

table, json, jsonl, csv or quiet. Quiet prints one transfer ID per row.

boolean

Short for --format json.

boolean

Short for --format jsonl.

string

Write to this file instead of standard output.

Byte counts cover a record’s whole observed lifetime; --since and --until select which records are listed. See filters and output formats.

Examples

filetrace transfers --active
filetrace transfers --remote 203.0.113.42 --min-bytes 1GB
filetrace transfers --confidence unknown --since 30m

Only the bytes that no file accounts for:

sudo filetrace transfers --confidence unknown

ID        PROCESS         FILE     REMOTE                BYTES  METHOD  CONFIDENCE
tr_s1001  metrics-daemon  unknown  192.168.65.1:25374    473 B  -       UNKNOWN
tr_se     file-server     unknown  127.0.0.1:45789     48.8 KB  -       UNKNOWN
tr_sd     file-server     unknown  127.0.0.1:49084         6 B  -       UNKNOWN
tr_sc     file-server     unknown  127.0.0.1:40477      195 KB  -       UNKNOWN

Observed since 2026-11-11 20:07:55. History is not kept across agent restarts.

In JSON, a record with a file has "event":"file_transfer". Unattributed bytes have "event":"network_transfer", no file object, and no method, operations or evidence:

sudo filetrace transfers --json --limit 2

[
 {"event":"file_transfer","transfer_id":"tr_3","timestamp":"2026-11-11T20:07:59.514Z","host":"web-01","platform":"linux","process":{"pid":1024,"ppid":772,"name":"file-server","executable":"/usr/local/bin/file-server"},"file":{"path":"/srv/export/media/files/stream.bin","inode":626330,"device":63,"size":40000000,"owner":"root","filesystem":"overlay","deleted":false},"network":{"protocol":"tcp","socket_id":16,"local_ip":"127.0.0.1","local_port":41814,"remote_ip":"127.0.0.1","remote_port":51871},"transfer":{"method":"sendfile","bytes_sent":16250000,"bytes_per_second":4239224,"operations":65,"started":"2026-11-11T20:07:56.193Z","duration_ms":3320,"state":"active","confidence":"exact","evidence":["direct_file_to_socket_transfer","file_identity","socket_identity","remote_endpoint"],"incomplete":false}},
 {"event":"network_transfer","transfer_id":"tr_s1001","timestamp":"2026-11-11T20:07:56.180Z","host":"web-01","platform":"linux","process":{"pid":152,"ppid":1,"name":"metrics-daemon","executable":"/metrics-daemon"},"network":{"protocol":"tcp","socket_id":4097,"local_ip":"192.168.65.7","local_port":2376,"remote_ip":"192.168.65.1","remote_port":25374},"transfer":{"bytes_sent":473,"bytes_per_second":0,"started":"2026-11-11T20:07:56.063Z","duration_ms":116,"state":"active","confidence":"unknown","incomplete":false}}
]

Exit codes

Code	Meaning
0	Success
1	General error
2	Invalid arguments, including an invalid `--path-regex`
3	Permission denied: the agent socket is not accessible to this user
4	No agent is running
5	Unsupported platform, or a `--method` this build does not observe
6	The configuration file cannot be read or is invalid
9	Partial results: events were lost in the queried time range

Records and identifiers explains transfer records and their IDs.
File attribution and confidence explains why bytes can stay unattributed.

Using the CLI

Monitoring commands

Agent and system

filetrace transfers: transfer records and unattributed bytes

Usage

What it shows

Options

Examples

Exit codes

​Usage

​What it shows

​Options

​Examples

​Exit codes

​Related pages

Usage

What it shows

Options

Examples

Exit codes

Related pages