I'd like to find out which files are opened on my system in which order, in order to prefetch them from disk. It seems that fanotify should be well suited to monitor the whole system for open events. But as far as I can tell, the fanotify_event_metadata structure does not have a field to contain the path. So how can I tell which path a given event refers to? Or is fanotify the wrong approach to find path names, and do I have to recursively register watches for the whole tree using inotify?
You can use readlink on /proc/self/fd/<fdnum>, where fdnum refers to the fd member of the struct fanotify_event_metadata for the event.