Some time back i moved from vmware to virtualbox, and am currently wondering if there are some old vmware files i can remove. Virtualbox uses the old vmware disk files, so first i checked via atime and lsof.
Why does atime not show all the files that lsof shows were open?
Steps were;
1. start vm
2. create and save dummy file in vm
3. run lsof on vm PID
4. shut down mv
5. run find to see which files were accessed
# lsof -p 2299 | grep 'VIRTUALS/Win-10-x64'
VirtualBo 2299 adam 42u REG 259,2 2453 10095159 /home/adam/VIRTUALS/Win-10-x64/Windows 7 x64.vmdk
VirtualBo 2299 adam 44u REG 259,2 2146762752 10094024 /home/adam/VIRTUALS/Win-10-x64/Windows 7 x64-s001.vmdk
VirtualBo 2299 adam 45u REG 259,2 2146762752 10094071 /home/adam/VIRTUALS/Win-10-x64/Windows 7 x64-s002.vmdk
VirtualBo 2299 adam 46u REG 259,2 2146762752 10094011 /home/adam/VIRTUALS/Win-10-x64/Windows 7 x64-s003.vmdk
VirtualBo 2299 adam 47u REG 259,2 2146762752 10094108 /home/adam/VIRTUALS/Win-10-x64/Windows 7 x64-s004.vmdk
VirtualBo 2299 adam 48u REG 259,2 2146762752 10094076 /home/adam/VIRTUALS/Win-10-x64/Windows 7 x64-s005.vmdk
VirtualBo 2299 adam 49u REG 259,2 2146762752 10094127 /home/adam/VIRTUALS/Win-10-x64/Windows 7 x64-s006.vmdk
VirtualBo 2299 adam 50u REG 259,2 2146762752 10094050 /home/adam/VIRTUALS/Win-10-x64/Windows 7 x64-s007.vmdk
VirtualBo 2299 adam 51u REG 259,2 2146762752 10094087 /home/adam/VIRTUALS/Win-10-x64/Windows 7 x64-s008.vmdk
VirtualBo 2299 adam 52u REG 259,2 2146762752 10094031 /home/adam/VIRTUALS/Win-10-x64/Windows 7 x64-s009.vmdk
VirtualBo 2299 adam 53u REG 259,2 2146762752 10094102 /home/adam/VIRTUALS/Win-10-x64/Windows 7 x64-s010.vmdk
VirtualBo 2299 adam 54u REG 259,2 2146762752 10094021
<snip>
# find VIRTUALS/Win10-vbox/ -atime -1 -type f
VIRTUALS/Win10-vbox/Win10-vbox.vbox
VIRTUALS/Win10-vbox/Logs/VBox.log
VIRTUALS/Win10-vbox/Logs/VBox.log.1
VIRTUALS/Win10-vbox/Win10-vbox.vbox-prev
#