一，工具简介
filegone 追踪文件消失的原因，无论是被删除还是被重命名。
二，代码示例
#!/usr/bin/pythonfrom __future__ import print_function
from bcc import BPF
import argparse
from time import strftime# arguments
examples = """examples:./filegone # trace all file gone events./filegone -p 181 # only trace PID 181
"""
parser = argparse.ArgumentParser(description="Trace why file gone (deleted or renamed)",formatter_class=argparse.RawDescriptionHelpFormatter,epilog=examples)
parser.add_argument("-p", "--pid",help="trace this PID only")
parser.add_argument("--ebpf", action="store_true",help=argparse.SUPPRESS)
args = parser.parse_args()
debug = 0# define BPF program
bpf_text = """
#include <uapi/linux/ptrace.h>
#include <linux/fs.h>
#include <linux/sched.h>st
)
)
