Perl script uses Ptrace for process tracing  Process Spy  ©
Scott Maxwell, Fotolia   Recently, I needed to investigate the
write activity of a Linux process and was surprised to discover
that CPAN had a Ptrace module. Ptrace is a technology that roots
in the Linux kernel, adding the ability to step through
processes and retrieve information on the data they use.
Debuggers such as GDB leverage this technology and build a user
interface on it.  To find out which files a process opens for
writing over the course of its lifetime, you can pass the
PTRACE_SYSCALL parameter to ptrace to make the process stop
whenever it issues a system call. Filtering out calls coming
from libc's open() function in write mode then reveals the
desired list of files. Invoking objdump -d /lib/libc.so.6 tells
you what libc does to open the specified file and return a file
descriptor (Figure 1).  Figure 1: The libc code that tells the
kernel to execute the open() system call.  To most of us,
disassembler output is incomprehensible at fir