Given file path, how can I determine which process creates it (and/or reads/writes to it)?
The lsof command (already mentioned in several answers) will tell you what process has a file open at the time you run it.
lsof is available for just about every unix variant.
lsof won't tell you about file that were opened two microseconds ago and closed one microsecond ago. If you need to watch a particular file and react when it is accessed, you need different tools.
If you can plan a little in advance, you can put the file on a LoggedFS filesystem. LoggedFS is a FUSE stacked filesystem that logs all accesses to files in a hierarchy. The logging parameters are highly configurable. FUSE is available on all major unices. You'll want to log accesses to the directory where the file is created. Start with the provided sample configuration file and tweak it according to this guide.
loggedfs -l /path/to/log_file -c /path/to/config.xml /path/to/directory tail -f /path/to/log_file
Many unices offer other monitoring facilities. Under Linux, you can use the relatively new audit subsystem. There isn't much literature about it (but more than about loggedfs); you can start with this tutorial or a few examples or just with the
auditctl man page. Here, it should be enough to make sure the daemon is started, then run
auditctl -w /path/to/file
(I think older systems need
auditctl -a exit,always -w /path/to/file) and watch the logs in
Well you could run
lsof repeatedly, and if you're lucky the culprit will hold the file open long enough for it to show. Ie.:
$ lsof -r1 /path/to/file
or for many files
$ lsof -r1 /path/to/folder/*
This will list all access to the given path at a certain point in time, once per second. This includes listing the PID of the process accessing the file.
If that doesn't work, that is, the file is opened and closed very quickly, which is often the case, I believe you need to look for more elaborate tools. Maybe loggedfs could be something?
If the once-per-second
lsof won't work, you could of course hack a while-loop that runs lsof repeatedly as fast as possible. Like:
$ while true; do lsof /paht/to/file; done;
Not pretty, but who knows, might just do it.
You can use
lsof for that:
$ lsof /tmp/file COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME less 4737 wena 4r REG 8,6 90700 1643536 /tmp/file
It says the process named
less is the keeping the file "/tmp/file" open.
NOTE: Strangely, that doesn't work if I use
nano. Am looking forward to better suggestions.
You can use
grep to find out the files used by chrome
$ ls -l /proc/*/fd | grep "chrome" lrwx------ 1 ba abc 64 Jul 16 22:19 104 -> /home/abc/.config/google-chrome/Default/Cookies lr-x------ 1 abc abc 64 Jul 16 22:19 113 -> /opt/google/chrome/nacl_irt_x86_64.nexe lrwx------ 1 abc abc 64 Jul 16 22:19 121 -> /home/abc/.cache/google-chrome/Default/Cache/data_0 lrwx------ 1 abc abc 64 Jul 16 22:19 122 -> /home/abc/.cache/google-chrome/Default/Cache/data_1 lrwx------ 1 abc abc 64 Jul 16 22:19 123 -> /home/abc/.cache/google-chrome/Default/Cache/data_2 lr-x------ 1 abc abc 64 Jul 16 22:19 125 -> /home/abc/.config/google-chrome/Dictionaries/en-US-3-0.bdic
Another way is to use
$ lsof | grep "chrome" chrome 2204 abc cwd DIR 8,5 4096 1441794 /home/abc chrome 2204 abc rtd DIR 8,5 4096 2 / chrome 2204 abc txt REG 8,5 87345336 5111885 /opt/google/chrome/chrome chrome 2204 abc mem REG 8,5 4202496 1443927 /home/abc/.cache/google-chrome/Default/Media Cache/data_3 chrome 2204 abc mem REG 8,5 1056768 1443926 /home/abc/.cache/google-chrome/Default/Media Cache/data_2 chrome 2204 abc mem REG 8,5 270336 1443925 /home/abc/.cache/google-chrome/Default/Media Cache/data_1 chrome 2204 abc mem REG 8,5 45056 1443924 /home/abc/.cache/google-chrome/Default/Media Cache/data_0