How would I find out all the files a particular process accesses?

I am using Ubuntu 9.04.

1 Answer 1


lsof will list open files and associated process IDs. It lists everything if no options are given.

There is an option, -p, to list open files for a single process. So for a process with PID 6714 this will list the files opened by that process:

    lsof -p 6714

To list only regular files grep can be used to filter the output of lsof:

    lsof -p 6714 | grep REG

If it needs to be more robust than with grep then the -F option can be used, but then it becomes more complex. From the lsof man page:

When the -F option is specified, lsof produces output that is suitable for processing by another program - e.g, an awk or Perl script, or a C program.

It depends on your requirements.

  • 1
    I like to add '-b' to lsof, it'll go a little quicker. Also, I add 2>/dev/null before the pipe to grep.
    – kbyrd
    Mar 24, 2010 at 3:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .