To identify applications that create files consuming disk space in the user's home directory, a background process called whomade has been developed, monitoring the appearance of new files using the fanotify mechanism. The project is written in C++ and is distributed under the GPLv3 license.
Data is stored in an SQLite3 database, which is periodically cleared of outdated information (for example, details about deleted files). To implement the required functionality, currently, whomade tracks file openings via fanotify, filtering out unnecessary events instead of directly monitoring file creation operations. Root privileges are required for its operation (necessary for fanotify).
Users of the MATE desktop environment are provided with an extension for the Caja file manager, which displays information about the process that created the selected file.
Source: opennet.ru
