filetrace inspect gathers everything the agent knows about one thing into a single report, from whichever side you approach it: a file, a process, a socket, a flow or a remote address. Each report ends with the time from which the agent’s history reaches.
Usage
Socket and flow IDs are the SOCKET and FLOW columns of
connections and flows, and the socket_id and flow_id fields of their machine-readable output.
Options
string
Only what was active at or after this time: a duration such as
10m, 1h or 7d, or an RFC 3339 timestamp.number
default:"20"
Rows per list. A list that is cut short ends with a line that says how many rows were left out.
boolean
Show remote addresses by host name where a reverse DNS lookup finds one.
string
default:"table"
table or json.boolean
Short for
--format json.string
Write to this file instead of standard output.
file
inspect file takes a path. The path may contain * wildcards if they match a single file; a pattern that matches several files is an error, and the command lists the matching transfers on standard error and exits with 2.
- FILE gives the file’s identity: device as major and minor number, inode, size, owner and filesystem as read when the file was first seen, and whether it has been deleted.
- TRANSFER HISTORY lists the most recent transfers, oldest first, with the time each started.
- TOTALS adds up the bytes sent and counts the distinct destinations and processes, the transfers and those still in progress.
- PROVENANCE counts the transfers by method and by confidence.
process
inspect process takes a process ID. It combines what the agent observed with what the system knows about a process that is still running: its cgroup and the number of files it has open.
- PROCESS identifies the process. For a process that has exited, Status gives its exit code or the signal that ended it, with the time; Cgroup then shows the cgroup ID, and Open files is left out, because the PID may by now belong to another process.
- NETWORK gives its open connections and its current rates with the totals.
- FILES counts its open files, its transfers in progress, the distinct files it sent and its transfers.
- TOP DESTINATIONS lists its remote addresses by current rate, then by bytes sent.
- FILES SENT lists its transfers, most recent first.
socket
inspect socket takes a socket ID from the SOCKET column of connections.
not yet known for an accepted connection whose owner has not sent or received yet. FLOWS lists the flows on the socket, one per process and remote endpoint.
flow
inspect flow takes a flow ID from the FLOW column of flows.
ip
inspect ip takes an IPv4 or IPv6 address, or a network in CIDR notation. The first section is titled ADDRESS for a single address and NETWORK for a network.
JSON output
--json prints one object. Its kind names the target, its lists hold the same records as the listing commands, and observed_since and events_lost close it:
The JSON lists are not cut by
--limit. JSON output schema describes every field.