File activity strace -e trace=file -fp PID (file) or strace -e trace=desc -fp PID (file descriptors) Common calls: access close – close file handle fchmod – change file permissions fchown – change file ownership
