Determine which process is creating a file

Question

Given file path, how can I determine which process creates it (and/or reads/writes to it)?

Answer 1

The lsof command (already mentioned in several answers) will tell you what process has a file open at the time you run it. lsof is available for just about every unix variant.

lsof /path/to/file

lsof won't tell you about file that were opened two microseconds ago and closed one microsecond ago. If you need to watch a particular file and react when it is accessed, you need different tools.

If you can plan a little in advance, you can put the file on a LoggedFS filesystem. LoggedFS is a FUSE stacked filesystem that logs all accesses to files in a hierarchy. The logging parameters are highly configurable. FUSE is available on all major unices. You'll want to log accesses to the directory where the file is created. Start with the provided sample configuration file and tweak it according to this guide.

loggedfs -l /path/to/log_file -c /path/to/config.xml /path/to/directory
tail -f /path/to/log_file

Many unices offer other monitoring facilities. Under Linux, you can use the relatively new audit subsystem. There isn't much literature about it (but more than about loggedfs); you can start with this tutorial or a few examples or just with the auditctl man page. Here, it should be enough to make sure the daemon is started, then run auditctl:

auditctl -a exit,always -w /path/to/file

and watch the logs in /var/log/audit/audit.log.

Answer 2

Well you could run lsof repeatedly, and if you're lucky the culprit will hold the file open long enough for it to show. Ie.:

$ lsof -r1 /path/to/file

or for many files

$ lsof -r1 /path/to/folder/*

This will list all access to the given path at a certain point in time, once per second. This includes listing the PID of the process accessing the file.

If that doesn't work, that is, the file is opened and closed very quickly, which is often the case, I believe you need to look for more elaborate tools. Maybe loggedfs could be something?

Hackland
If the once-per-second lsof won't work, you could of course hack a while-loop that runs lsof repeatedly as fast as possible. Like:

$ while true; do lsof /paht/to/file; done;

Muhaha, erh. Not pretty, but who knows, might just do it.

Answer 3

lsof |grep (filename)

This will show you the process that is currently using the file.

Answer 4

You can use lsof for that:

$ lsof /tmp/file
COMMAND    PID USER   FD   TYPE DEVICE SIZE/OFF    NODE NAME
less      4737 wena    4r   REG    8,6    90700 1643536 /tmp/file

It says the process named less is the keeping the file "/tmp/file" open.

NOTE: Strangely, that doesn't work if I use geany or nano. Am looking forward to better suggestions.