Skip to content



ftruncate - scan event that occurs when the function is called to truncate a file


The ftruncate() function truncates the file referenced by fd to the length specified by length. If the file previously was larger than length, the extra data is discarded. If the file previously was shorter, it is extended and the extended part reads as null bytes.

The ftruncate() function can be used to resize just the size of the file, without altering its contents.


  • fd:int[K] - file descriptor for the file to be truncated
  • length:off_t[K] - desired length of the file

Available Tags

  • K - Originated from kernel-space.






To measure the size of the file before and after the truncate.

Example Use Case

ftruncate() can be used to truncate a log file after it has exceeded a certain size.


If the ftruncate operation fails, it returns -1 and sets errno.

  • fstat - to obtain information about file size prior to truncating
  • open - to obtain a file descriptor for a given file
  • write - to write to a file
  • read - to reed from a file

This document was automatically generated by OpenAI and needs review. It might not be accurate and might contain errors. The authors of Tracee recommend that the user reads the "events.go" source file to understand the events and their arguments better.