08:22 <khaled> Hello systemtap gurus, I am trying to monitor a directory to see all the processes that create/read/write/remove files in it, Just the directory root no more. I noticed that whenever I use the dentry tapset inode_* set of functions they always return "read fault" on the passed inode.

08:22 <khaled> my strategy is as follows,

08:22 <khaled> stap dirmon.stp <directoryInodeToMonitor>

08:22 <khaled> probe vfs.{read,write}

08:22 <khaled> 1. Get the parent dentry of the current file from inode->i_dentry->first

08:22 <khaled> 2. if the parent dentry = <directoryInodeToMonitor> then print the info I need i.e. execname

08:22 <khaled>

08:22 <khaled> But this always return "read fault" so my question is, Am I walking in the right direction? or should be another way?

08:22 <khaled> Thank You

20:55 <irker267> systemtap: fche systemtap.git:refs/heads/master * release-4.0-91-geb8c8de / buildrun.cxx runtime/addr-map.h runtime/linux/addr-map.c runtime/linux/autoconf-access_ok_2args.c runtime/linux/probe_lock.h session.cxx staprun/common.c: linux 5.0-rc3 adaptations http://tinyurl.com/y97gevaa