> ## Documentation Index
> Fetch the complete documentation index at: https://filetrace.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Get started with Filetrace

> Install Filetrace on Linux, check that the kernel can be monitored, start the agent and find which process sends which file, in five steps.

This quickstart takes a Linux machine from nothing to its first answer: you install Filetrace, check that the kernel supports it, start the agent, and list the files that processes send over the network. You need root access and Linux 6.1 or later.

**1. Install Filetrace**

The installer sets up the package repository that fits the system (apt, dnf, yum, zypper or apk), installs the `filetrace` package and starts the `filetrace-agent` service.

```bash theme={null}
curl -fsSL https://filetrace.eorlov.org/install.sh | sudo sh
```

To install without starting the service, append `-s -- --no-start`. [Installation](https://filetrace.mintlify.site/installation.md) covers manual repository setup, Homebrew and release archives.

**2. Check the kernel**

`filetrace doctor` loads and attaches every probe, reports what the kernel accepted, and removes the probes again.

```bash theme={null}
sudo filetrace doctor
```

The report ends with a status line. `STATUS: READY` means every probe is attached:

```text theme={null}
PROBES
  [OK] tracepoint sched_process_exec
  [OK] tracepoint inet_sock_set_state
  [OK] fexit inet_sendmsg
  [OK] fexit vfs_read
  [OK] fexit do_splice_direct
  ...

STATUS: READY
```

Any other status is explained in [Troubleshooting](https://filetrace.mintlify.site/guides/troubleshooting.md).

**3. Make sure the agent is running**

Run `filetrace` without arguments. It reports whether the agent is running and which probe set it uses:

```bash theme={null}
sudo filetrace
```

```text theme={null}
● RUNNING   Linux eBPF (trampolines), standard mode
  0 active transfers   0 processes   0 B/s outbound   100.0% of events delivered
```

If it reports `NOT RUNNING`, start the service with `sudo systemctl enable --now filetrace-agent`, or run the agent in the foreground with `sudo filetrace agent run`.

**4. Watch transfers live**

The live view lists the file transfers in progress with their process, destination, method, rate and confidence. Press `q` to quit.

```bash theme={null}
sudo filetrace watch
```

```text theme={null}
ACTIVE FILE TRANSFERS
PROCESS      FILE                         DESTINATION    METHOD           RATE  CONFIDENCE
nginx 1245   /var/www/stream.bin          203.0.113.25   sendfile    6.67 MB/s  EXACT
nginx 1245   /var/www/video.mp4           198.51.100.10  sendfile        0 B/s  EXACT
python 892   /data/export/customers.csv   203.0.113.50   read-write      0 B/s  INFERRED
```

**5. Ask about what happened**

The agent keeps a bounded history in memory from the moment it started. List the files that were sent, then look at one of them from every side:

```bash theme={null}
sudo filetrace files --since 1h
sudo filetrace inspect file /var/www/video.mp4
```

```text theme={null}
TRANSFER HISTORY
────────────────────────────────────
TIME                 PROCESS  PID   REMOTE               BYTES    METHOD    CONFIDENCE
2026-11-11 12:00:04  nginx    1245  198.51.100.10:48175  47.7 MB  sendfile  EXACT
```

## Next steps

> [card] [Find who sends a file](https://filetrace.mintlify.site/guides/trace-a-file.md)
>
> Go from a file path to the processes and addresses involved.

> [card] [Investigate an address](https://filetrace.mintlify.site/guides/investigate-a-destination.md)
>
> Go from a remote address or network to the files sent to it.

> [card] [Understand confidence](https://filetrace.mintlify.site/concepts/attribution.md)
>
> Learn what EXACT, INFERRED and UNKNOWN rest on.

> [card] [Export telemetry](https://filetrace.mintlify.site/integrations/overview.md)
>
> Send metrics and events to Prometheus or OpenTelemetry.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.