As almut suggested, there are a number of tools (varying by flavour of Un*x) which let you watch the system calls made by a running program, regardless of what language it may be.
For Linux, the program is strace, and you do something like this:
$ strace perl -e 'open FOO, ">/tmp/foo"; print FOO "bar";'
...snip...
open("/tmp/foo", O_WRONLY|O_CREAT|O_TRUNC|O_LARGEFILE, 0666) = 3
ioctl(3, SNDCTL_TMR_TIMEBASE, 0xbfffe2f0) = -1 ENOTTY (Inappropriate i
+octl for device)
_llseek(3, 0, [0], SEEK_CUR) = 0
fstat64(3, {st_mode=S_IFREG|0644, st_size=0, ...}) = 0
fcntl64(3, F_SETFD, FD_CLOEXEC) = 0
brk(0) = 0x8143000
brk(0x8144000) = 0x8144000
write(3, "bar", 3) = 3
close(3) = 0
exit_group(0) = ?
See the open in the first line? That's a call to the system function open. You can find out what all the arguments mean by running man 2 open in your shell. The 3 at the end of that line is the return of that function - it is the file handle for that opened file. You can then follow the write and close functions that relate to that file.
You can use strace to watch what a running program is doing with the -p option, but be careful of doing this on a production box as some older versions of the linux kernel have a bug that could cause your program to halt when you exit strace.
The equivalent of strace on Solaris is truss. On MacOS X you need a combination of ktrace and kdump (read both man pages). |