I have a directory /some/dir, and I see that new files appear there all the time. How do I find out which process is creating those files?
3 Answers
Try lsof +r2 | grep '/some/dir'
. This will show processes accessing /some/dir and refresh every 2 seconds.
-
3Thaks, this is quite close to what I need, as it produces the whole list of open files first, then filters by /some/dir. However if processes create the files very quickly and don't keep them open, I understand that the above may miss some even. I think in that case the only option is the audit subsystem, right? Sep 24, 2011 at 10:18
-
1Your assumption is right. Another idea is to use inotifywait, see linux.die.net/man/1/inotifywait– weeheavySep 24, 2011 at 11:30
-
1thanks, I had considered inotify tools before, however I found that they work purely at the filesystem level and don't seem to be able to provide info about who did what. Sep 24, 2011 at 11:41
Use kernel audit
subsystem
auditctl -w /some/dir/ -p war -k whatsgoingon
That sets up a hook waiting for something happening under /some/dir/.
Then make sure you have auditd
daemon running. After that just wait until files appear and see from /var/log/auditd.log
or wherever it in your system writes and read what happened and by what process.
-
Thanks, this looks like it does exactly that, although it requires the audit tools installed which probably aren't everywhere by default. But ok, if one needs that information, they can always be installed. Sep 24, 2011 at 10:19
-
As a note to people seeing this: you can't place watches on the top-level directories (prohibited by the kernel) Feb 1, 2019 at 11:34
-
3That's really an efficient way! Thanks a lot!!! BTW, when you're done, you can remove all the hooks to avoid writing the audit log forever by
auditctl -D
. You may useauditctl -l
to list all hooks.– RobertMar 27, 2019 at 9:08
lsof
can help:
# lsof -r1 /some/dir/*
-
1Thanks. Is it correct that the above command only tells me who is accessing existing files but doesn't show anything for newly created files? My understanding is that /some/dir/* expands to the list of files present at the time the command is invoked. Sep 24, 2011 at 10:15