> ## Documentation Index
> Fetch the complete documentation index at: https://filetrace.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Find which process sends a file and where

> Start from a file path and find every process that sent it, the addresses it went to, how many bytes left, and how certain each attribution is.

When you need to know whether a file left the machine, start from its path. Filetrace answers with the processes that sent it, the remote addresses, the bytes each socket accepted and the method, so you can tell a web server serving a download from a script copying an export. This guide walks through the commands from a quick check to a full report.

> [!NOTE]
>
> The agent must be running, and it only knows what happened since it started. Run the commands with `sudo` when the agent runs as root.

## Check a single file

`filetrace inspect file` reports everything known about one file: its identity, every transfer, totals and the provenance of the attribution.

```bash theme={null}
sudo filetrace inspect file /var/www/video.mp4
```

```text theme={null}
FILE
────────────────────────────────────
Path:             /var/www/video.mp4
Device:           253:0
Inode:            366815
Size:             47.7 MB
Owner:            www-data
Deleted:          no

TRANSFER HISTORY
────────────────────────────────────
TIME                 PROCESS  PID   REMOTE               BYTES    METHOD    CONFIDENCE
2026-11-11 12:00:04  nginx    1245  198.51.100.10:48175  47.7 MB  sendfile  EXACT

TOTALS
────────────────────────────────────
Total sent:       47.7 MB
Destinations:     1
Processes:        1
Transfers:        1
Active transfers: 1

PROVENANCE
────────────────────────────────────
sendfile:         1 transfer
Exact:            1

History starts at 2026-11-11 12:00:04, when the agent started.
Nothing earlier is kept.
```

Read it from the bottom up: the last lines say how far back the answer reaches. If the file is not in the history, it was not read or sent since the agent started, or the history has since forgotten it (see [Records and history](https://filetrace.mintlify.site/concepts/data-model.md#bounded-in-memory-history)).

A path may contain `*` wildcards as long as they match a single file.

## Check a directory or pattern

`filetrace files` lists every file associated with a transfer. Narrow it with `--path`, which accepts `*` wildcards, or `--path-regex`, which takes a POSIX extended regular expression:

```bash theme={null}
sudo filetrace files --path '/data/*' --since 1h
sudo filetrace files --path-regex '\.(csv|sql|tar\.gz)$' --min-bytes 10MB
```

Each row is one transfer of one file to one destination, with the bytes the socket accepted:

```text theme={null}
FILE                    PROCESS  DESTINATION   BYTES    METHOD      CONFIDENCE
/data/export/users.csv  python   192.0.2.10    85.2 MB  read-write  INFERRED
```

Add `--deleted` to list only files that no longer have a directory entry.

## Decide how sure the answer is

The `CONFIDENCE` column says what the association rests on:

* **EXACT** with method `sendfile`: the kernel moved the file's data to the socket itself. The file was sent.
* **INFERRED** with method `read-write`: the same thread read the file and then sent on the socket within two seconds, with no receive in between. The payload cannot be proven to come only from the file.

To list only certain associations, filter on the level:

```bash theme={null}
sudo filetrace files --path '/data/*' --confidence exact
```

A `*` after the level marks a transfer during which events were lost; its byte counts may be incomplete. [File attribution and confidence](https://filetrace.mintlify.site/concepts/attribution.md) explains both methods and their limits.

## Follow the process

Once you know the PID, look at the process from its side: its connections, rates, top destinations and every file it sent.

```bash theme={null}
sudo filetrace inspect process 1245
```

```text theme={null}
TOP DESTINATIONS
────────────────────────────────────
DESTINATION      OUTBOUND     SENT  RECEIVED
198.51.100.10   3.98 MB/s  15.5 MB       0 B
```

## Catch the next transfer

History answers questions about the past. To see a file the moment it is sent, follow the event stream with a path filter:

```bash theme={null}
sudo filetrace events --follow --type file_transfer --file '/data/*'
```

```text theme={null}
12:00:06.737 FILE_TRANSFER
  pid=1245
  process=nginx
  file=/var/www/stream.bin
  inode=366820
  socket=434
  remote=203.0.113.25:39063
  bytes=2000000
  method=sendfile
  confidence=exact
```

Each event carries the bytes of one collection interval, so a long transfer appears as several events. To be notified outside the terminal, export `file_transfer` events over [OpenTelemetry](https://filetrace.mintlify.site/integrations/opentelemetry.md) or stream them from the [gRPC API](https://filetrace.mintlify.site/integrations/grpc-api.md).

## Keep a record

Write the answer in a machine-readable form for a ticket or a later comparison:

```bash theme={null}
sudo filetrace files --path '/data/*' --format csv --output exports.csv
sudo filetrace inspect file /data/export/users.csv --json --output users-csv.json
```

See [Use Filetrace output in scripts](https://filetrace.mintlify.site/guides/automation.md) for JSON processing and exit codes.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.