How can I tell what files a process has open?

Solution 1:

I do love lsof, but I think it's overkill for a simple question like this. The /proc filesystem contains everything you want to know. Perhaps an example would be best:

# ps ax|grep tail
 7196 pts/4    S+     0:00 tail -f /var/log/messages
 8773 pts/0    R+     0:00 grep tail
# ls -l /proc/7196/cwd
lrwxrwxrwx 1 insyte insyte 0 2009-07-29 19:05 /proc/7196/cwd -> /home/insyte
# ls -l /proc/7196/fd
total 0
lrwx------ 1 insyte insyte 64 2009-07-29 19:05 0 -> /dev/pts/4
lrwx------ 1 insyte insyte 64 2009-07-29 19:05 1 -> /dev/pts/4
lrwx------ 1 insyte insyte 64 2009-07-29 19:02 2 -> /dev/pts/4
lr-x------ 1 insyte insyte 64 2009-07-29 19:05 3 -> /var/log/messages

So as you can see, the /proc/$PID directory contains a symlink called "cwd" that links the the CWD of the process. The same is true for the open filedescriptors listed in /proc/$PID/fd.

The /proc/$PID hierarchy contains a wealth of information about all running processes. Worth poking around in!

Solution 2:

If you have the command lsof available [whcih most *nix flavors do] you would use:

lsof -p NNN

to list files open by process NNN. I haven't used BSD in a while but from memory fuser is a close parallel to lsof.

I'm not sure of a command to find the cwd of a process but on Linux cwd is symlinked into the /proc directory of the process ie. /proc/NNN/cwd.

---

Solution 3:

if you know the processes PID, you can just issue an

lsof | grep YOURPID

Quick and easy to remember.

or

lsof -c yourprogramexecutable

---

Solution 4:

Try lsof if it's installed on your system

D