Search code examples
kubernetesfilesystems

Most accessed files on filesystem in Kubernetes

I am looking for a way to keep track of most accessed files on a filesystem. I understand that setting atime or lazytime as a mount option might work. But, this doesn't seem to be an option in Kubernetes.

Also, even if this is set, it will only show that the file was accessed. Not the number of times the file was accessed.

Also, auditd is not an option since it doesn't work in a container.

Is there any other way to keep track of which file/s were accessed and how many times in a filesystem when running in K8s?

Solution

  • The best option to do this seems to be to use https://github.com/fsnotify/fsnotify. It doesn't currently support getting notified when a file is read. But, it should be possible to hack fsnotify to make that happen, especially for Linux based systems.