Finally, snoop catches up with the latest kernels. This new release moves the FD scanning logic into userspace and improves usability by monitoring parent directories too and attaching on the fly to newly created targets.
Snoop 0.2.0 is out.
An important new feature is the ability to attach to arbitrary file descriptors when using the /proc/<pid>/fd/<fd#> format. This allows attaching to virtually any type of FD (sockets, anonymous pipes, etc.).
Enjoy.
This new release introduces inotify-based file monitoring & automatic re-attaching. A new compatibility layer allows snoop to work on a wider range of kernels.
This release contains a major bugfix and some usability improvements. Now the snoop utility handles the character device setup transparently.
This is the first public release, see the README for details & instructions.
The basic functionality is in place, I'm looking forward for some feedback.