How to know a which file a process is writing or reading from?

squirrel96

New Member
Hi all,

Since Every process in linux is writing from a file or reading from a file. Is there any way I can know which file a process is reading or writing from?
 


JasKinasis

Well-Known Member
The lsof command will list all opened files and the processes that have them open.
So you could use lsof and use something like grep or ag to filter out the files that are currently open by a particular program.
e.g.
Code:
lsof | grep {nameofprogram}
Where {nameofprogram} is firefox, or whatever program you want to investigate.
This will list ALL files that are open by any given programs main process and ALL child processes that the main process has started.

So to see all of the files that are currently in use by firefox (and it's many sub-processes), you would use:
Code:
lsof | grep firefox
Which would give you a long list of files.

If you only want to see the files that are open by a particular process - another thing you could do is get the PID for the main process and pass that as a parameter to lsof...
Code:
lsof -p $(pgrep firefox)
The above gets the PID of the main firefox process and lists all files opened by that specific process. But not any of it's child-processes.

Or if you already know the PID of the process you're interested in simply:
Code:
lsof -p {PID}
Where {PID} is the PID you want to list the open files for.
e.g.
Code:
lsof -p 1234
Again - it will only list files that are open by that specific process, not any of it's parent, or child processes.
 
Last edited:

Members online


Top