Determine what files are being accessed by a process

Question

How would I find out all the files a particular process accesses?

I am using Ubuntu 9.04.

Answer 1

lsof will list open files and associated process IDs. It lists everything if no options are given.

There is an option, -p, to list open files for a single process. So for a process with PID 6714 this will list the files opened by that process:

    lsof -p 6714

To list only regular files grep can be used to filter the output of lsof:

    lsof -p 6714 | grep REG

If it needs to be more robust than with grep then the -F option can be used, but then it becomes more complex. From the lsof man page:

When the -F option is specified, lsof produces output that is suitable for processing by another program - e.g, an awk or Perl script, or a C program.

It depends on your requirements.