Determine what files are being accessed by a process
How would I find out all the files a particular process accesses?
I am using Ubuntu 9.04.
lsof will list open files and associated process IDs. It lists everything if no options are given.
There is an option, -p
, to list open files for a single process. So for a process with PID 6714 this will list the files opened by that process:
lsof -p 6714
To list only regular files grep can be used to filter the output of lsof:
lsof -p 6714 | grep REG
If it needs to be more robust than with grep then the -F
option can be used, but then it becomes more complex. From the lsof man page:
When the -F option is specified, lsof produces output that is suitable for processing by another program - e.g, an awk or Perl script, or a C program.
It depends on your requirements.