ftruncate¶

Intro¶

ftruncate - scan event that occurs when the function is called to truncate a file

Description¶

The ftruncate() function truncates the file referenced by fd to the length specified by length. If the file previously was larger than length, the extra data is discarded. If the file previously was shorter, it is extended and the extended part reads as null bytes.

The ftruncate() function can be used to resize just the size of the file, without altering its contents.

Arguments¶

fd:int[K] - file descriptor for the file to be truncated
length:off_t[K] - desired length of the file

Available Tags¶

K - Originated from kernel-space.

Hooks¶

sys_ftruncate¶

Type¶

kprobes

Purpose¶

To measure the size of the file before and after the truncate.

Example Use Case¶

ftruncate() can be used to truncate a log file after it has exceeded a certain size.

Issues¶

If the ftruncate operation fails, it returns -1 and sets errno.

fstat - to obtain information about file size prior to truncating
open - to obtain a file descriptor for a given file
write - to write to a file
read - to reed from a file

This document was automatically generated by OpenAI and needs review. It might not be accurate and might contain errors. The authors of Tracee recommend that the user reads the "events.go" source file to understand the events and their arguments better.