Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a tool to monitor what processes open what files on the system so you can track down which process keeps touching a specific file?

Lsof can find out if you run it while the process has the file open, but if it is a short lived process that runs every once in a while, you can't catch it with lsof. Need something that uses kernel tracing.

share|improve this question
Have you checked out inotify? See @Kees's answer here for example:… There are a couple of links on my answer here:… – belacqua Apr 8 '11 at 20:13
@jgbelacua neither of those is quite what I'm looking for. Inotify can tell you when a given file is touched, and lsof can tell you what files a process has open, or what process has a file open, but I need to figure out what process keeps touching a file, then closing it before I can run lsof to catch it. – psusi Apr 9 '11 at 3:02
Related:… – ændrük May 14 '11 at 22:44
up vote 6 down vote accepted

You could perhaps use audit system for that. It is a little heavyweight, but something like this should work (in /etc/audit/audit.rules):

# delete all other rules

# watch the file in question
-w /path/to/file -p rwxa

and then I think you need to restart auditd:

sudo service audit restart

(In case you don't have it installed, it is in package auditd.) The culprit can then be found in /var/log/audit/audit.log.

share|improve this answer
Perfect! That is exactly what I was looking for. – psusi Jul 2 '11 at 0:24

Unfortunately the mechanism Linux uses to allow one to monitor files is inotify, which does not provide enough information to extract useful data: you only get the file name and the action that was done.

I've tried using something like this:

sudo inotifywait -mr somedir --format "%w%f" | while read file; do echo -n "$file => ";lsof -b $file; echo ""; done

This listens to inotify events on the specified directory and for each event it runs lsof to try to catch the process that touches the file. Unfortunately for most accesses that I tested (such as using an editor to write to a file) the LSOF command is just to slow and doesn't manage to catch the offending process.

If your processes do some more intensive IO on the problematic files, then your mileage may vary. Good luck.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.