Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'd like to better understand which programs are modifying a specific file1 during a reboot. Can I set something up to log this kind of information?

Polling for which processes currently have the file open won't work, as the file may only be open for a few milliseconds.

Can kernel tracing be used to collect this information?

1 /var/lib/alsa/asound.state if you're curious, but I'm interested in a general solution.

share|improve this question

This can be achieved with the fuser tool. It lists the process ID of all processes accessing a specific file. Try,

fuser -u . see which files are "open" in your home directory, the process ID's involved and the username owning those processes.

In your case, I'm not sure this will be useful since you're trying to monitor a reboot. I suspect that rc.local will execute too late in the reboot to capture anything useful with, say,

watch -n 0.5 "fuser -u /var/lib/alsa/asound.state"

Hmm - I've just tried dumping this to a file and the output isn't very pretty. But if this can be resolved, then perhaps something can be achieved with cron?

share|improve this answer
lsof is another tool that might be useful, if it is wrapped in something. – belacqua Feb 2 '11 at 21:01
Not come across that, but you're right - lsof has better output actually! It lists the name of the process, the user, the PID, the name of the file and more. – Scaine Feb 2 '11 at 21:32
I don't think -f does anything. (Source) – ændrük Feb 2 '11 at 23:28
I would keep the- f to make this command more interesting to read aloud. – Jim Schubert Feb 3 '11 at 0:38
I've removed the -f (the man page states that it's silently ignored anyway). ændrük, I have no idea how to capture the information that fast. I find the output from tailing the watch command pretty difficult to read anyway, so running it with say -n .1 will be even uglier. I think another solution may be required. Sorry. – Scaine Feb 3 '11 at 16:43

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.