filetrace watch shows what the machine is sending, live: the file transfers in progress with the process, the destination, the method and the current rate of each. On a terminal it draws a dashboard that refreshes every second and switches between files, processes and connections with single keys; otherwise it prints a snapshot per interval. When no agent is running, it collects in the foreground for as long as it runs.
Usage
The dashboard
- The header names the host, the system and its kernel version, and the state:
LIVE,PAUSEDwhile refreshing is paused, orDEGRADEDwhen the collector has lost events recently. - The counters give the transfers in progress, the active processes and the outbound rate of the whole machine. With
--direction inboundthe inbound rate replaces the outbound one; with--direction bothboth are shown. - The view: file transfers, processes or connections, chosen with the keys below.
- The confidence line counts the transfers in progress by confidence, and the events the collector has lost since it started.
- The key line shows the keys, with the current view highlighted.
Views
In the files view, a path too long for the terminal is shortened at its start, with
..., so that the file name stays visible. A * after a confidence level marks a transfer during which events were lost. The processes view ranks processes by the rate they send at; with --direction inbound it shows INBOUND and RECEIVED instead of OUTBOUND and SENT, and with --direction both it shows OUTBOUND, FILES, CONNECTIONS, INBOUND and TOTAL. The network view lists open connections.
Keys
The keys work in upper case too, and
h also toggles the help screen.
Snapshots without the dashboard
With--no-ui, or whenever standard output or standard input is not a terminal, watch prints a snapshot per interval instead of a dashboard, so you can log activity to a file:
--limit says otherwise:
[output] timestamps = false in the configuration leaves out the time line.
Without an agent
When no agent is serving the socket,watch starts a collector in the foreground and says so on standard error:
[agent] settings of the configuration file, exports nothing and stops when watch ends. If the agent is running but its socket is not accessible to your user, watch reports Permission denied instead; run it with sudo.
How the filters apply
--sort orders the transfers and defaults to rate.
Options
string
default:"1s"
Refresh interval, such as
500ms or 2s. The shortest is 100 ms.string
default:"outbound"
Traffic that ranks processes and connections:
outbound, inbound or both.boolean
Print a snapshot per interval instead of a dashboard. This is the default when output is not a terminal.
number
Only this process.
string
Only processes with this name.
* matches any run of characters. Alias: --name.string
Only processes of this user, by name or numeric ID.
string
Only processes in this cgroup, by numeric ID or cgroup directory.
number
Only processes in this network, PID or mount namespace, given as the inode number that
ls -Li /proc/<pid>/ns shows.string
Only this file.
* matches any run of characters, / included. Alias: --file.string
Only this remote address or CIDR network.
string
default:"all"
Only this protocol:
tcp, udp or all.string
exact, strong, inferred, unknown or all.string
At least this many bytes, such as
1KB, 100MB or 1GB.string
default:"rate"
Order of the transfers:
bytes, rate, process or file.boolean
Show the destinations of the files view by host name where a reverse DNS lookup finds one. A name appears on the refresh after its lookup finishes. The lookups tell the DNS resolver which addresses are being looked at.
number
Rows per table. By default, as many as fit on the terminal, or 10 with
--no-ui.