snapshot_file

The snapshot_file gadget shows open files for running processes.

Getting started

Running the gadget:

kubectl gadget

$ kubectl gadget run ghcr.io/inspektor-gadget/gadget/snapshot_file:latest [flags]

ig

$ sudo ig run ghcr.io/inspektor-gadget/gadget/snapshot_file:latest [flags]

Flags

--paths

Show full file paths (by default, only dentry names are shown).

Default value: "false"

--file-type-mask

Filter which file types to display using a bitmask. By default, only regular files and directories are shown (bitmask value 17).

Supported file types:

• REGULAR
• SOCKET
• PIPE
• BPF_MAP
• DIRECTORY
• CHAR_DEV
• BLOCK_DEV
• SYMLINK
• OTHER

The bitmask order, from left to right, corresponds to the file types listed above.

Guide

Run a pod / container:

kubectl gadget

$ kubectl run --restart=Never --image=busybox test-snapshot-file -- sh -c 'echo hello > /tmp/demo.txt && tail -f /tmp/demo.txt'
pod/test-snapshot-file created

ig

$ docker run --name test-snapshot-file -d busybox /bin/sh -c 'echo hello > /tmp/demo.txt && tail -f /tmp/demo.txt'
...

Now, run the gadget and see how it shows the open file:

kubectl gadget

$ kubectl gadget run snapshot_file:latest
K8S.NODE         K8S.NAMESPACE   K8S.PODNAME         K8S.CONTAINERNAME   COMM   PID   TID   FD   PATH      TYPE       FLAGS    
minikube-docker  default         test-snapshot-file  test-snapshot-file  tail   5432  5432  3    demo.txt  REGULAR    O_RDONLY  
^C

ig

$ sudo ig run snapshot_file:latest -c test-snapshot-file
RUNTIME.CONTAINERNAME             COMM               PID        TID   FD         PATH            TYPE            FLAGS              
test-snapshot-file                tail               5321       5321  3          demo.txt        REGULAR         O_RDONLY
^C

Finally, clean the system:

kubectl gadget

$ kubectl delete pod test-snapshot-file

ig

$ docker rm -f test-snapshot-file