exit4file intoduction

An eBPF tool used to trace the read/write/delete of every files for EXT4

What for

ext4file is used to monitor the I/O patterns(buffer or direct) of each file in the target ext4 FS. To prevent confusion caused by files having the same name, the output of ext4file also includes metadata such as the file's node ID, parent node ID, and whether it has been deleted.

Why ext4file

In the current repository, there exist block-layer tools to monitor I/O patterns of whole disk(such as biopattern, biolatency, etc.) and VFS-layer tools to trace file lifecycle and I/O behavior of files throughout the entire VFS (such as filelife and vfsstat).
However, the above tools lack finer-grained tracking at the file level.

• biopattern can only track the proportion of random I/O and sequential I/O occurring on a single hard drive device relative to all I/O(Other block-level tools have the same problem: they cannot track down to the file level with finer granularity).
• vfsstat tracks file creation, deletion, reading, writing, and other behaviors at the VFS level, while ignoring finer-grained distinctions at the file level.
• filelife ignores I/O and only focuses on the creation and deletion of files.
• To prevent excessive output, filetop only displays part of the data, and filetop's I/O tracking cannot further determine whether it is buffer or direct.

How ext4file

Run ext4file before executing your test. You can refer to ./ext4file -h to get the usage of the tool

Show I/O pattern of every ext4 file.

Usage: ./ext4file [-h, --help] [-d <dir>, --dir==<dir>] [-o <file>, --output==<file>] [interval] [count]

Options:
  -d, --dir=<dir>              Trace the specific device(FS) mounted on this dir
  -o, --output=<file>          Output to a specific file(selective)
  -h, --help                   Show this help
  interval                     Specify the amount of time in seconds between each report
  count                        Limit the number of reports (default: unlimited)

Examples:
  ./ext4file -d /mnt/ext4                      # Trace the device mounted on '/mnt/ext4'
  ./ext4file -d /mnt/ext4 1 10                 # Print 10 reports at 1 second intervals
  ./ext4file -d /mnt/ext4 -o output 1 10       # Print 10 reports at 1 second intervals to ./output

The output could be:

root@server:/home/nbw/OpenSource/biohint/libbpf-tools# ./ext4file -d /mnt/ext4File/
EXT4 FS Info: blocks_count=3750232064 blocks_per_group=32768 bg_cnt=114448
Tracing Ext4 read/write... Hit Ctrl-C to end.
2026-01-14 13:58:21
file_name            inode      pa_inode   hint   buffer_read     direct_read     buffer_write    direct_write    delete
test3                83361794   83361793   0      0               0               0               0               False
test2                34         2          0      8               0               1               0               False
dir1                 83361793   2          0      0               0               0               0               False
dir2                 440467457  2          0      0               0               0               0               True
test3                33         2          0      8               0               1               0               False
test1                33         2          0      8               0               1               0               True
test3                440467458  440467457  0      0               0               0               0               True

The introduction for each field is as follows:

• inode: the inode ID of the file.
• file_name: file name of the file(not path).
• pa_node: parent inode ID of the file.
• hint: the attribute used by FDP SSD.
• buffer_read: the count of buffer read occurred in the file.
• direct_read: the count of direct read occurred in the file.
• buffer_write: the count of buffer write occurred in the file.
• direct_write: the count of direct write occurred in the file.
• delete: has this file been deleted?

Target Audience

This tool can be used by developers of the ext4 file system who are interested in certain file I/O patterns.