Is there a way to find out what process wrote to a file?

Question

The file /sys/devices/platform/samsung/leds/samsung::kbd_backlight/brightness gets written to by some process each time the screen wakes up from being blank.

Is there a way to find out which process writes to this file?

Answer 1

Well, my initial thought was to use inotify a la inotify-tools, but it seems that is impossible, because "The inotify API provides no information about the user or process that triggered the inotify event." (source) Sometimes it's helpful to know what won't work, too, so here it is.

fanotify is a separate, competing notify framework for Linux, which is newer and more robust, and the API does contain information about the process ID (pid) of the program that did the event.

I'm not sure if Fedora 17 has a fanotify command built in (or similar). If not, you can see a sample fanotify program here. It does print out the Process ID (pid) of the process that did the event, so you can compile that program (if it's still compatible with the latest fanotify ABI on Fedora 17) and run it and it should work. See line 231 of this file.