draios/sysdig — pull request #230 by ryanchapman (2014-08-21 04:41:15+00:00)
Title: Add a new chisel, spy_file, which watches file read/write activity.

This was written with the following use case in mind: identify what
process is writing to a file. Without a kernel level utility like
sysdig, this is sometimes impossible. strace can identify a
particular process which writes to a file, but if you have no
idea what process might be writing to a file, it proves to be
a limited tool.

Example usage: sysdig -c spy_file "/var/log/messages w"
would show all write activity to /var/log/messages
...
22:07:06.751032503 syslogd(25251) W /var/log/messages Aug 20 22:07:06 web43 daemon.py[24071]: failed to send nsca passive check result to 'nagios01.initech.com'
...