Skip to main content
Version: latest

top_file

The top_file gadget reports periodically the read/write activity by file.

Getting started​

Running the gadget:

$ kubectl gadget run ghcr.io/inspektor-gadget/gadget/top_file:latest [flags]

Flags​

--all-files​

Trace all files types. By default, only regular files are traced

Default value: "false"

--pid​

Show only events generated by process with this PID

Default value: "0"

Guide​

This example shows how to use this gadget. To do so, we will run an application that performs some disk I/O activity.

Before starting our application, let's start our top_file gadget to be sure it captures all the events from the beginning:

$ kubectl gadget run top_file:latest --pod mypod
K8S.NODE     K8S.NAMESPACE          K8S.PODNAME            K8S.CONTAINERNAME               PID  READS RBYT… WRIT… WBYT… FILE                  COMM             T

The T column indicates the type of the file: R for regular files, S for sockets, and O for other (including pipes). By default only regular files are shown; use the --all-files option to show all file types.

In another terminal, let's create our application. It'll install git and then clone the linux source code:

kubectl run -it mypod --rm --image ubuntu -- /bin/sh -c "apt-get update && apt-get install -y git && git clone https://github.com/torvalds/linux"

We can see how the top_file terminal shows the files that are read and written by the application. The File field shows the absolute path of the file being accessed. For instance, http, apt-get and apt-config are reading a lot of files when updating the packages list and installing packages:

K8S.NAMESPACE               K8S.PODNAME                 K8S.CONTAINERNAME                       PID    READS  RBYTES  WRITES  WBYTES FILE                       COMM            K8S.NODE
default                     mypod                       mypod                               1786428       64  262144       0       0 /var/lib/apt/lists/archiv… apt-get         minikube
default                     mypod                       mypod                               1786428       10  589883       0       0 /var/lib/apt/lists/securi… apt-get         minikube
default                     mypod                       mypod                               1786428        2  110977       0       0 /var/lib/apt/lists/securi… apt-get         minikube
default                     mypod                       mypod                               1786428        6   24576       0       0 /etc/group                 apt-get         minikube
default                     mypod                       mypod                               1786730        3    2400       0       0 /usr/lib/x86_64-linux-gnu… dpkg            minikube
default                     mypod                       mypod                               1786428     1494 977912…       0       0 /var/lib/apt/lists/archiv… apt-get         minikube
default                     mypod                       mypod                               1786608        3   21287       0       0 /var/lib/apt/lists/partia… store           minikube
default                     mypod                       mypod                               1786730        1     832       0       0 /usr/lib/x86_64-linux-gnu… dpkg            minikube
default                     mypod                       mypod                               1786730        2    8192       0       0 /etc/dpkg/dpkg.cfg         dpkg            minikube
default                     mypod                       mypod                               1786608        0       0      28  722475 /var/lib/apt/lists/partia… store           minikube
default                     mypod                       mypod                               1786608        0       0      28  589765 /var/lib/apt/lists/partia… store           minikube
default                     mypod                       mypod                               1786608       74  602300       0       0 /var/lib/apt/lists/partia… store           minikube
default                     mypod                       mypod                               1786608     2049 167783…       0       0 /var/lib/apt/lists/partia… store           minikube
default                     mypod                       mypod                               1786608        0       0       2   17989 /var/lib/apt/lists/partia… store           minikube
default                     mypod                       mypod                               1786608        0       0      40  973998 /var/lib/apt/lists/partia… store           minikube
default                     mypod                       mypod                               1786608        4   32284       0       0 /var/lib/apt/lists/partia… store           minikube
default                     mypod                       mypod                               1786729        3    2400       0       0 /usr/lib/x86_64-linux-gnu… rm              minikube
default                     mypod                       mypod                               1786428       10  649015       0       0 /var/lib/apt/lists/archiv… apt-get         minikube
default                     mypod                       mypod                               1786428        4  197340       0       0 /var/lib/apt/lists/archiv… apt-get         minikube
default                     mypod                       mypod                               1786428      188 123166…       0       0 /var/lib/apt/lists/archiv… apt-get         minikube
...

After the initial installation is done, we can see how git uses a temporary file to store the repository being cloned.

K8S.NAMESPACE               K8S.PODNAME                 K8S.CONTAINERNAME                       PID    READS  RBYTES  WRITES  WBYTES FILE                                      COMM            K8S.NODE
default                     mypod                       mypod                               1799742      266   81944       0       0 /linux/.git/objects/pack/tmp_pack_dzzrva  git             minikube

By default the top_file gadget prints a summary each second until users press Ctrl + C. Both the number of summaries and the interval can be customized using --map-fetch-count and --map-fetch-interval flags, respectively. For example, with the following values, the gadget will run for 10 seconds in total, printing 5 summaries every 2 seconds:

kubectl gadget run top_file:latest --map-fetch-count 5 --map-fetch-interval 2s