Ask HN: Cross-platform per process file access tracing

Hi,

I am looking for a platform independent way (at least Linux/MacOS/Windows) to trace all file operations for one process (and its child processes). For PID X, I want a list of all files which are opened by this process and in what mode (read or write).

Two ways I come up so far, but both are not exactly what I was looking for: * chroot or lxc to change root to a FUSE filesystem which traces all operations: Works only on Linux (lxc) or Linux/MacOS(chroot) and requires sudo. * ptrace: Only for POSIX compatible OS, requires a lot of platform-specific code for the different system calls.

Has anyone some suggestions for my problem? Thanks!