Skip to main content
Filetrace answers one family of questions from every angle: which files left this machine, who sent them, where they went, and how sure that is. Each page below starts from a real question, gives the commands that answer it, and shows what the output means and where the answer can mislead.

​
Pick a scenario

​
A method that works for all of them

  1. Frame the question as a filter. Start from the file, the process, the destination or the time. The filters page gives the value syntax; the flags reference lists every option.
  2. Read the confidence. EXACT means the kernel moved the file to the socket itself; INFERRED means a thread read the file and then sent on the socket. Treat INFERRED as strong evidence, not proof. See attribution.
  3. Check for loss. A * next to a confidence level, a WARNING on standard error, or a non-zero filetrace_events_dropped_total means attribution is degraded for that window. filetrace stats shows where the loss happened.
  4. Go one level deeper with inspect. Once a name or an address looks interesting, inspect shows every side of it at once.
  5. Export what you need to keep. The agent’s history is in memory and starts when it starts. For anything you must keep, send the OTLP log records to a collector, or scrape the metrics.

​
The same answer, three ways

The scenarios use whatever fits at the time: a command for a one-off question, a metric for a dashboard, a log record for a system that outlives the agent.
The observability recipes wire the metric and log forms to Prometheus, Grafana and an OpenTelemetry Collector.