Given file path, how can I determine which process creates it (and/or reads/writes to it)?
The lsof command (already mentioned in several answers) will tell you what process has a file open at the time you run it.
If you can plan a little in advance, you can put the file on a LoggedFS filesystem. LoggedFS is a FUSE stacked filesystem that logs all accesses to files in a hierarchy. The logging parameters are highly configurable. FUSE is available on all major unices. You'll want to log accesses to the directory where the file is created. Start with the provided sample configuration file and tweak it according to this guide.
Many unices offer other monitoring facilities. Under Linux, you can use the relatively new audit subsystem. There isn't much literature about it (but more than about loggedfs); you can start with this tutorial or a few examples or just with the
and watch the logs in
Well you could run
or for many files
This will list all access to the given path at a certain point in time, once per second. This includes listing the PID of the process accessing the file.
If that doesn't work, that is, the file is opened and closed very quickly, which is often the case, I believe you need to look for more elaborate tools. Maybe loggedfs could be something?
Muhaha, erh. Not pretty, but who knows, might just do it.
This will show you the process that is currently using the file.
You can use
It says the process named
NOTE: Strangely, that doesn't work if I use
|show 1 more comment|