How do I find out what process created a file

[eladmin]

There are files being written to /tmp every minute and I want to find out the process id of the process creating those files. How can I find that out?

 

[Annihilannic]

If you can catch them while they are still open by the process that is creating them you can use fuser to find out.

Do the filenames or the file contents contain any clues? What user are they owned by?

Annihilannic.

 

[eladmin]

Thanks.

I used fuser to see what processes were running that were writing to /tmp (I used fuser -c). I couldn't tell which one is writing the files. The files are owned by a user that is running an application with a number of processes.

The files are data files but are not readable so, unfortunately, I cannot tell from the files what process is creating them.

 

[bi]

Have you tried using strings <filename> | more on the files? sometimes you can get enough from that output to make a good guess.

 

[SamBones]

The command [tt]lsof[/tt] will list open files and who has them open. You have to do this while they have it open though.

Hope this helps.