Which file Linux server is writing to?

Solution 1:

Try iotop. On Debian/Ubuntu:

apt-get install iotop

Then iotop will show you I/O per process. You can then inspect the file descriptors for the process in question if in need of more data - for example with ls -l /proc/<PID>/fd or lsof -p <PID>.

Solution 2:

Since I/O accounting isn't available, maybe you could use a solution based on inotify. This is included in the kernel since 2.6.13. Using inotifywatch from inotify-tools you can watch for changes to any file on your system with inotifywatch -r /. It will take a long time to establish all the watches, and you may have to increase /proc/sys/fs/inotify/max_user_watches. Inotifywatch will run until you interrupt it with ctrl-c. After you interrupt, for each file that was accessed it will statistics on the operations that were performed. For example

$ inotifywatch -r ~
Establishing watches...
Finished establishing watches, now collecting statistics.
total  access  modify  close_write  open  moved_from  moved_to  create  filename
6099   0       6092    2            2     1           1         1       /home/example/foo