Linux which process writes to file

How to Find Out Who is Using a File in Linux

In this article, we will explain how to find out who is using a particular file in Linux. This will help you know the system user or process that is using an open file.

We can use the lsof command to know if someone is using a file, and if they are, who. It reads kernel memory in its search for open files and helps you list all open files. In this case, an open file may be a regular file, a directory, a block special file, a character special file, a stream, a network file and many others – because in Linux everything is a file.

Lsof is used on a file system to identify who is using any files on that file system. You can run lsof command on Linux filesystem and the output identifies the owner and process information for processes using the file as shown in the following output.

To list user specific opened files, run the following command replace tecmint with the actual user name.

Another important use of lsof is to find out the process listening on a specific port. For example identify the process listening on port 80 using the following command.

Note: Since lsof reads kernel memory in its search for open files, rapid changes in kernel memory may result into unpredictable outputs. This is one of the major downsides of using lsof command.

For more information, look at the lsof man page:

That’s all! In this article, we have explained how to know who is using a particular file in Linux. We have shown how to identify the owner and process information for processes using an open file. Use the feedback form below to reach us for any questions or comments.

If You Appreciate What We Do Here On TecMint, You Should Consider:

TecMint is the fastest growing and most trusted community site for any kind of Linux Articles, Guides and Books on the web. Millions of people visit TecMint! to search or browse the thousands of published articles available FREELY to all.

If you like what you are reading, please consider buying us a coffee ( or 2 ) as a token of appreciation.

We are thankful for your never ending support.

Источник

How to find which process a file is being written by in Linux?

Some people ask a file is being written by one process and they want to check this process, but they cannot find the process even with sof.

This question is very common and there are many solutions, here we introduce a straightforward method.

In Linux, each file will be stored on one device and of course there will be a relative inode, then we can use vfs.write to know who is writing the inode on one specified device continuously. Luckily there is inodewatch.stp in the installation package of systemtap, it locates at /usr/local/share/doc/systemtap/examples/io. It is used foe above.

Let take a look at the code:

1. «color:rgb(85, 85, 85)» >$ cat inodewatch.stp
2. #! /usr/bin/env stap
3. probe vfs.write, vfs.read
4. <
5. # dev and ino are defined by vfs.write and vfs.read
6. if (dev == MKDEV( $1 , $2 ) # major/minor device
7. && ino == $3 )
8. printf ( «%s(%d) %s 0x%x/%u\n» ,
9. execname(), pid(), probefunc(), dev, ino)
10. >

This usage of this method is stap inodewatch.stp major minor ino. Let’s create this scenario,: dd will continuously write on one file, we find out the ino of this file and its major and minor of its device, we can find the answer by executing stap.

Let’s take a look at the scenario codes:

1. $ pwd
2. /home/chuba
3. $ df
4. Filesystem 1K-blocks Used Available Use% Mounted on
5. .
6. /dev/sdb1 1621245336 825209568 713681236 54% /home
7. .
8. $ ls -al /dev/sdb1
9. brw-rw—- 1 root disk 8, 17 Oct 24 11:22 /dev/sdb1
10. $ rm -f test.dat && dd if =/dev/zero of=test.dat
11. ^C9912890+0 records in
12. 9912890+0 records out
13. 5075399680 bytes (5.1 GB) copied, 26.8189 s, 189 MB/s

This terminal will simulate the file write, at the same time another terminal will check which process is doing this. Here we can find the major/minor of the device is 8/17.

1. $ stat -c ‘%i’ test.dat
2. 25337884
3. $ sudo stap /usr/local/share/doc/systemtap/examples/io/inodewatch.stp 8 17 25337884
4. dd(740) vfs_write 0x800011/25337884
5. dd(740) vfs_write 0x800011/25337884
6. dd(740) vfs_write 0x800011/25337884
7. dd(740) vfs_write 0x800011/25337884
8. dd(740) vfs_write 0x800011/25337884
9. dd(740) vfs_write 0x800011/25337884
10. .

Have you noticed that dd is the process, PID is 740. It’s done. Mission completed.

Источник

How can I determine what process has a file open in Linux?

I’d like to determine what process has ownership of a lock-file. The lock-files are simply a file with a specific name that has been created.

So, how can I determine what process has a particular file open in Linux? Preferably a one-liner type or a particular Linux tool solution would be optimal.

5 Answers 5

You can also use fuser for this:

On most Linux systems lsof NAME does the job:

Having a file open is not a lock because, if each process has to check whether the file is open first and not proceed if it is or create/open it if it isn’t, then two processes could quite well check simultaneously, both find that it isn’t open, then both create or open it.

To use a file as a lock, the check-and-lock operation has to be a single uninterruptable operation. You can achieve this in a Unix filesystem by creating a file with read-only mode and removing it to unlock. If the file exists (and is read only) the file creation will fail, so you get check-and-lock in a single atomic operation.

If your locking process is a shell script that will be running as a daemon, you can get this effect by using umask , a per-process setting that sets the permissions that new files are created with:

This also writes the owning process’ PID into the file, which solves your other problem: cat /var/lock/foo As regards the specific question «Which processes have this file open?», this can be useful when you want to unmount a filesystem but can’t because some process has a file open in it. If you don’t have those commands available, you can ask /proc as root:

ls -l /proc/*/cwd | grep ‘/var/lock/foo$’

or, as a mortal user:

ls -l /proc/*/cwd 2>/dev/null | grep ‘/var/lock/foo$’

Источник

Find Which Linux Process is Using Your Files or Ports

Find Which Linux Process is Using Your Files or Ports

If you have ever tried to unmount a filesystem, USB stick, cdrom, etc… but found that it was busy and therefore could not be unmounted, you will like the fuser command. Fuser’s man page tells us that fuser will “Show which processes use the named files, sockets, or filesystems.” But you can do more than that! You can also use fuser to send signals to your processes telling them to shutdown, terminate, pause, etc…

Use Fuser to Find Which Processes are Using a Filesystem

One of the things that used to annoy me the most was when I would try to unmount a filesystem and I would find that a process was using it and I would get the “device is busy” message.

Now, when I get that message, I simply use fuser to find which processes are using files in that filesystem.

Example: Show linux processes using /myfilesystem

As we look at the output from the fuser command above, we see that both the root user and the mary user have processes in the filesystem. We can review the columns and get lots of information. The USER, PID, and COMMAND columns are similar to the columns from the ps command and are self-explanatory. The USER column tells us the user id for the process. The PID column tells us the process id of that process. The COMMAND column tells us the command the process is running as well as the userid again in parenthesis. The ACCESS column tells us how the process is using the file. The ACCESS column may include he following letters referencing these access types:

ACCESS Column Code	Code’s Definition
F	file is open for writing.
f,o	The process has an open file.
r	The process’ root or home directory is on this filesystem (chroot).
c	The process’ current directory is on this filesystem.
e,t	The process is executing a file.
m,s	The process has a mapped file or is using a shared library.

Using LSOF (List Open Files)

We can also use the “lsof” (list open files) command to show a similar report.

Example: Using lsof to find processes using a specified filesystem.

Find and Killing Processes Using Fuser

For the more confident system administrators, fuser has a kill option (-k) that can be used to kill whatever processes are found using a file or filesystem.

Example: Find whatever processes are using the /myfilesystem and shut them down!

Interestingly, in the above example, we found that our very process was using the /myfilesystem filesystem. We ran the fuser command with the kill option (-k) telling it to kill the processes. As ours was amongst them, it killed our process.

Use Fuser to Find Which Processes / Daemons are Listening on a Port

Fuser has additional uses. Sometimes, we want to find out what process and userid are utilizing a port on our system. We can specify the IP version with -v4 for IPv4 or -v6 for IPv6.

Example: Find out what process is handling our http traffic on port 80

We were able to find out that varnishd is handling our http traffic on port 80/tcp.

Kill Whatever Process is Listening on a Port

Let’s imagine that you need to shutdown whatever is running on port 8001/tcp for some reason. Perhaps, you have a process that normally runs on that port, but something else has taken it while you have been performing some maintenance. We can use fuser to find and kill the process in one command by using the fuser command with the -k option.

Example: Find and kill whatever process is listening on port 8001/tcp

Specifying the Signal Fuser Will Use as it Kills a Process

You can change the signal used when killing a process using fuser by simply listing it as an option to your fuser command. You can list the available signals using “fuser -l”.

and then use withever signal you want it to use:

Other Resources

Fuser is a powerful tool that can help you find which linux process is using your files or ports. Here are a few other resources that can give you additional information on fuser.

Источник

Investigate disk writes further to find out which process writes to my SSD

I try to minimize disk writes to my new SSD system drive. I’m stuck with iostat output:

As I see there are writes to sdb. How can I resolve which process writes?

I know about iotop, but it doesn’t show which filesystem is being accessed.

2 Answers 2

You could at least start with iotop. It won’t tell you which filesystem is being written but it will give you some processes to investigate.

It shows instantaneous disk reads and writes and the name of the command reading or writing.

If you are trying to catch a process that writes infrequently, you can use the —accumulate option or log the output to a file:

Obviously the writing of the log file will show up in the results, but you should also be able to grep for other processes writing to disk.

By this point you should be able to find some candidate suspect processes. The left column in iotop shows the pid. Next, find out which file descriptor the process is writing to:

You should see output like this when the process writes:

The first argument to write is the file descriptor. We are probably looking for values greater than 2, because 0, 1 and 2 are just stdin, stdout and stderr. File descriptor 4 looks interesting.

You can now find out what file the file descriptor points to with:

Which should yield output like:

Look at the 4th column. 4w means that file descriptor 4 is open for writing and the file is another_test_file .

It is possible for a process to open, write and then close a file, in which case lsof would not show it. You might catch this happening with:

Источник