strace

strace spies on what System calls a program makes.

strace [flags] command

Some useful strace flags:

-e open search for the open system call
-f follow subprocesses and strace them too
-p 673 what is this process doing?
-c summarizes output with CPU time for each syscall
-s 50 shows you the first 50 lines of strings
-o file.txt stores output for later
-y converts file descriptor numbers to filenames; newer flag

You can see a list of system calls here.


If you want to see what files dig is opening (reading) just do strace -f -e open dig.

Jvns has an awesome zine on the what and how for strace.