Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 6 down vote favorite
3

I have a directory /some/dir, and I see that new files appear there all the time. How do I find out which process is creating those files?

share|improve this question

3 Answers

up vote 7 down vote

Use kernel audit subsystem

auditctl -w /some/dir/ -p war -k whatsgoingon

That sets up a hook waiting for something happening under /some/dir/.

Then make sure you have auditd daemon running. After that just wait until files appear and see from /var/log/auditd.log or wherever it in your system writes and read what happened and by what process.

share|improve this answer
Thanks, this looks like it does exactly that, although it requires the audit tools installed which probably aren't everywhere by default. But ok, if one needs that information, they can always be installed. – homer5439 Sep 24 '11 at 10:19
up vote 4 down vote

Try lsof +r2 | grep '/some/dir'. This will show processes accessing /some/dir and refresh every 2 seconds.

share|improve this answer
2  
Thaks, this is quite close to what I need, as it produces the whole list of open files first, then filters by /some/dir. However if processes create the files very quickly and don't keep them open, I understand that the above may miss some even. I think in that case the only option is the audit subsystem, right? – homer5439 Sep 24 '11 at 10:18
Your assumption is right. Another idea is to use inotifywait, see linux.die.net/man/1/inotifywait – weeheavy Sep 24 '11 at 11:30
thanks, I had considered inotify tools before, however I found that they work purely at the filesystem level and don't seem to be able to provide info about who did what. – homer5439 Sep 24 '11 at 11:41
up vote 0 down vote

lsof can help:

# lsof -r1 /some/dir/*
share|improve this answer
Thanks. Is it correct that the above command only tells me who is accessing existing files but doesn't show anything for newly created files? My understanding is that /some/dir/* expands to the list of files present at the time the command is invoked. – homer5439 Sep 24 '11 at 10:15

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.