Question

I would like to print the total number of bytes read/written by a Linux process. For example, I run

gcc -c a.c

and would like to see how many bytes in total did GCC, including its children, request from the Linux kernel and how many bytes they sent to the kernel.

Incomplete solutions to this problem are:

• The fields rchar and wchar in /proc/PID/io show the number of read/written bytes so far. It does not account for child processes. It is lost as soon as the process terminates.

• A tool such as strace can be used to print out the syscalls of a process and its children (such as: read, write syscalls), but it is unable to aggregate the number of bytes read/written.

How to print the total number of bytes read/written by a Linux process and its child processes?

Answer 1

A little awk, and strace is what you want.

strace -e trace=read,write -o ls.log ls

gives you a log of the read and write syscalls. Now you can take this log and sum the last column like this

cat ls.log | grep read | awk 'BEGIN {FS="="}{ sum += $2} END {print sum}'

You might wan’t to change the grep to match only a read at the beginning of the line.