How to trace/monitor the I/O of a Linux command

I ran find / -name abc.html and a short time after I ran this command again. This time it was very fast, so I know the find must be caching the result somewhere.

How can I find out where the cache is stored?


Indeed, as @zongfu pointed out, find does not cache its results in a file, but rather the kernel is caching the directories find is reading so they can be read again without touching the disk, which is why it is faster. If you still want to see what kind of IO a program is doing though, you can use strace. This program runs another program you specify and logs the system calls the program makes. Without any arguments it will print them all, which can be a lot of information, so you man want to limit it to only certain calls, such as open() so you can see what files the program is going to open. This would look like:

strace -eopen someprogram

find does not cache anything, especially onto disk. The reason why the second run is a lot faster is because the Linux caches the accessed data (in this case directory listings) in memory (see free).