Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How would I find out all the files a particular process accesses?

I am using Ubuntu 9.04.

share|improve this question
up vote 6 down vote accepted

lsof will list open files and associated process IDs. It lists everything if no options are given.

There is an option, -p, to list open files for a single process. So for a process with PID 6714 this will list the files opened by that process:

    lsof -p 6714

To list only regular files grep can be used to filter the output of lsof:

    lsof -p 6714 | grep REG

If it needs to be more robust than with grep then the -F option can be used, but then it becomes more complex. From the lsof man page:

When the -F option is specified, lsof produces output that is suitable for processing by another program - e.g, an awk or Perl script, or a C program.

It depends on your requirements.

share|improve this answer
    
I like to add '-b' to lsof, it'll go a little quicker. Also, I add 2>/dev/null before the pipe to grep. – kbyrd Mar 24 '10 at 3:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .