I have a superuser ssh access to a third-party ubuntu 14.10 box with misconfiguration: some process creates lots of temp files in a dir (and does not clear them, depleting inode limit slowly). Is it any easy way to find out what process exactly is creating the files? I assume that only one process adds files to that dir and initially dir is empy (i can clear it). Of course I can speculate that it's some nginx process executing PHP code or some Python daemon - but knowing for sure will save me a lot of time.
If the process is still running and still has the file open "lsof" will tell you its process id. If it is more transient, then you might use inotify to let you "pounce" on a file that's just been created: this set of tools has some userspace stuff you can wrap in shell script, and some decent examples.
I trust you've tried looking in the files - who knows what clues might be in there?
Or, you could use fatrace - helpfully found by the original questioner - nicely played! Seems to wrap inotify/lsof type functionality which is handy.