lsof -p 12345 will list all the files opened by process whose pid is 12345 but only for a particular instant of time.

How can we continuously monitor a process from the start to end(until process is terminated) to list/show every single file accessed by the process during its whole lifetime?


3 Answers 3


Try with strace -p 12345; it should do what you are trying to achieve.

The output can be filtered to only display opened files (Dan D.'s comment):

strace -e open -p 12345

Note: you can also trace quickly running processes with strace -e open <command>.

  • output is not friendly and too much extra things.
    – MA1
    Oct 21, 2011 at 7:39
  • You can fix that by piping - strace -p {pid} | grep -i "Open" | tee files_opened.log. The key is grep, which lets you filter the output for the system call you want (e.g. open()).
    – user26996
    Mar 8, 2012 at 10:26
  • 11
    @Ninefingers Actually strace can do that better than grep with the -e option: strace -e open
    – Dan D.
    Mar 8, 2012 at 10:48
  • @DanD oh yeah, ofc :)
    – user26996
    Mar 8, 2012 at 10:51
  • When I kill the strace command, it also kills the thing it is tracing. Why is this happening (cygwin)? May 1, 2015 at 5:52

The new utility fatrace will do this: https://launchpad.net/fatrace/

sudo fatrace | grep '(6514)'

Don't use the -p option, it means the opposite of what it means in lsof or other utilities.


This will loop re-running your command and clearing the screen each time:

watch "lsof -p 12345"

WARNING: this will miss quick file accesses and is only suitable to see long standing files

  • 2
    This is somewhat clumsy compared to the other answer using strace. Dec 5, 2013 at 17:32
  • 2
    That's inaccurate solution - a process may use files in between executions of lsof
    – Dor
    Jan 31, 2014 at 8:47
  • @Dor you can set the timing of lsof to sub 1 second and increase it's precision. While it's clumsy compared to others, you are wrong in that it's an inaccurate solution. Feb 18, 2014 at 2:31
  • If your looking at a long file operation (like a database backup) this may a good simple alternative.
    – jcalfee314
    Feb 18, 2014 at 14:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.