I don't know of any place where the kernel exposes the filenames associated with the blocks that it has cached. According to this answer

http://stackoverflow.com/a/4941371

The best you could probably do even with a custom kernel module would be to get a list of inodes and devices. From there you would still likely need to walk the filesystem looking for those files.

You may then ask "But, how does fincore know about the files I've listed?" Or you might not, but I found the method pretty clever, so here it is. The fincore tool works by doing the following:

• calling mmap(2) on the given file (https://code.google.com/p/linux-ftools/source/browse/linux-fincore.c#260)
• calling mincore(2) on the memory region returned by mmap (https://code.google.com/p/linux-ftools/source/browse/linux-fincore.c#279)

The mincore system call tells you whether the given pages of memory are in core memory (ie, would not cause a page fault when accessed). Since mmap lazily loads the mapped file, and we haven't read any of the mapped region yet, any pages that would not cause a page fault must otherwise be part of our cache.

I don't know of any place where the kernel exposes the filenames associated with the blocks that it has cached. According to this answer

https://stackoverflow.com/a/4941371

The best you could probably do even with a custom kernel module would be to get a list of inodes and devices. From there you would still likely need to walk the filesystem looking for those files.

You may then ask "But, how does fincore know about the files I've listed?" Or you might not, but I found the method pretty clever, so here it is. The fincore tool works by doing the following:

• calling mmap(2) on the given file (https://code.google.com/p/linux-ftools/source/browse/linux-fincore.c#260)
• calling mincore(2) on the memory region returned by mmap (https://code.google.com/p/linux-ftools/source/browse/linux-fincore.c#279)

The mincore system call tells you whether the given pages of memory are in core memory (ie, would not cause a page fault when accessed). Since mmap lazily loads the mapped file, and we haven't read any of the mapped region yet, any pages that would not cause a page fault must otherwise be part of our cache.

I don't know of any place where the kernel exposes the filenames associated with the blocks that it has cached.

You may then ask "But, how does fincore know about the files I've listed?" Or you might not, but I found the method pretty clever, so here it is. The fincore tool works by doing the following:

• calling mmap(2) on the given file (https://code.google.com/p/linux-ftools/source/browse/linux-fincore.c#260)
• calling mincore(2) on the memory region (https://code.google.com/p/linux-ftools/source/browse/linux-fincore.c#279)

The mincore system call tells you whether the given pages of memory are in core memory (ie, would not cause a page fault when accessed). Since mmap lazily loads the mapped file, and we haven't read any of the mapped region yet, any pages that would not cause a page fault must otherwise be part of our cache.

I don't know of any place where the kernel exposes the filenames associated with the blocks that it has cached. According to this answer

http://stackoverflow.com/a/4941371

The best you could probably do even with a custom kernel module would be to get a list of inodes and devices. From there you would still likely need to walk the filesystem looking for those files.

You may then ask "But, how does fincore know about the files I've listed?" Or you might not, but I found the method pretty clever, so here it is. The fincore tool works by doing the following:

• calling mmap(2) on the given file (https://code.google.com/p/linux-ftools/source/browse/linux-fincore.c#260)
• calling mincore(2) on the memory region returned by mmap (https://code.google.com/p/linux-ftools/source/browse/linux-fincore.c#279)

The mincore system call tells you whether the given pages of memory are in core memory (ie, would not cause a page fault when accessed). Since mmap lazily loads the mapped file, and we haven't read any of the mapped region yet, any pages that would not cause a page fault must otherwise be part of our cache.