fstatat - Linux


fstatat analyzes file system statistics gathered from the fstat() system call. It provides a detailed breakdown of file system usage, access patterns, and performance metrics. It’s particularly useful for performance tuning, forensic analysis, and understanding file system behavior.


fstatat [OPTIONS]... [PATH]...


  • -v, –verbose: Print detailed output including individual file statistics.
  • –top-files: Print the top N (default 10) files sorted by various metrics.
  • –sort-by: Sort output by a specific field (e.g., size, atime).
  • –filter-by: Filter results based on a field and value (e.g., uid=1000).
  • –count: Print only the count of statistics.
  • –help: Display help information.


Print basic statistics:

fstatat /home

Print detailed output for a specific file:

fstatat -v /home/user/myfile.txt

Sort files by size:

fstatat --top-files 100 --sort-by size

Common Issues

  • Insufficient permissions: Ensure you have read permissions for the specified file paths.
  • Empty output: The file system may be empty or have no recent activity.
  • Incorrect sorting field: Verify that the field you’re sorting by is valid.


Combine with fuser: Find out processes using specific files:

fstatat /tmp/testfile | awk '{print $1}' | xargs fuser -uv

Create alerts based on file access:

watch -n 60 fstatat --top-files 10 | grep /sensitive/directory

Related Commands

  • fstat: Display file system statistics for a specific file.
  • stat: Display file system statistics for a specific file.
  • iostat: Display disk-related statistics.
  • df: Display file system disk space usage.