There's a bzip2 process running in the background and I have no idea where it came from. It's eating up a lot of resources. Can I do a reverse lsof to see which files are being accessed by this process?

I've suspended the process for the time being.


I'm not sure why that'd be a "reverse lsof" -- lsof does exactly that. You can pass it the -p flag to specify which PIDs to include/exclude in the results:

$ lsof -p $(pidof bzip2)
  • 3
    Reverse from lsof /path/to/file (which I guess is the mode of operation Pieter is used to). – Gilles 'SO- stop being evil' Sep 30 '11 at 23:35
  • Note that if you have existing filters to lsof, you can use -a to AND them instead of ORing them: lsof -a -i TCP -p 12345. – wchargin Sep 20 '19 at 0:28

In the /proc/ directory you can find details of the running processes, in separate directories, by their PID. Their file descriptors are enumerated in the fd/ sub-directory:

ls -l /proc/$(pidof -s bzip2)/fd/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.