I have a superuser ssh access to a third-party ubuntu 14.10 box with misconfiguration: some process creates lots of temp files in a dir (and does not clear them, depleting inode limit slowly). Is it any easy way to find out what process exactly is creating the files? I assume that only one process adds files to that dir and initially dir is empy (i can clear it). Of course I can speculate that it's some nginx process executing PHP code or some Python daemon - but knowing for sure will save me a lot of time.


If the process is still running and still has the file open "lsof" will tell you its process id. If it is more transient, then you might use inotify to let you "pounce" on a file that's just been created: this set of tools has some userspace stuff you can wrap in shell script, and some decent examples.

I trust you've tried looking in the files - who knows what clues might be in there?

Or, you could use fatrace - helpfully found by the original questioner - nicely played! Seems to wrap inotify/lsof type functionality which is handy.

  • It perfectly shows all create file events but doesn't show process id. Of course this rogue process closes files after they are created, so lsof is of no use :(. – grigoryvp Apr 9 '15 at 3:49
  • 1
    It seems that fatrace perfectly shows a process that modified a file. Can you please update your answer so i can accept it? – grigoryvp Apr 11 '15 at 17:43
  • @EyeofHell if you manage to find the answer to your own question, then there's absoutely nothing wrong with creating an answer to your own question and accepting it - in fact it's encouraged as it is available for others to reference in future. – dbr Apr 11 '15 at 21:04
  • @dbr Thanks, in normal situations I do so. But this answer does all the job, fatrace was one google away from inotify-tools under "inotify-tools process name" search query :). – grigoryvp Apr 12 '15 at 3:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.