How to find which process a file is being written by in Linux?

5,778 0
Summary

A common challenge in Linux is identifying the process actively writing to a specific file. A straightforward method involves leveraging SystemTap and its inodewatch.stp script, typically found in the SystemTap examples directory. This script monitors vfs.write and vfs.read probes, allowing developers to filter events by a file's device major/minor numbers and its inode. To use it, one first determines these identifiers for the target file, then executes stap inodewatch.stp to reveal the writing process and its PID. This approach effectively pinpoints the responsible process by observing low-level file system operations.

Some people ask a file is being written by one process and they want to check this process, but they cannot find the process even with sof.

This question is very common and there are many solutions, here we introduce a straightforward method.

In Linux, each file will be stored on one device and of course there will be a relative inode, then we can use vfs.write to know who is writing the inode on one specified device continuously. Luckily there is inodewatch.stp in the installation package of systemtap, it locates at /usr/local/share/doc/systemtap/examples/io. It is used foe above.

Let take a look at the code:

  1. "color:rgb(85, 85, 85)">$ cat inodewatch.stp
  2. #! /usr/bin/env stap
  4. probe vfs.write, vfs.read
  5. {
  6.   # dev and ino are defined by vfs.write and vfs.read
  7.   if (dev == MKDEV($1,$2) # major/minor device
  8.   && ino == $3)
  9.   printf ("%s(%d) %s 0x%x/%u\n",
  10.   execname(), pid(), probefunc(), dev, ino)
  11. }

This usage of this method is stap inodewatch.stp major minor ino. Let's create this scenario,: dd will continuously write on one file, we find out the ino of this file and its major and minor of its device, we can find the answer by executing stap.

Let's take a look at the scenario codes:

  1. $ pwd
  2. /home/chuba
  3. $ df
  4. Filesystem    1K-blocks  Used Available Use% Mounted on
  5. ...
  6. /dev/sdb1    1621245336 825209568 713681236  54% /home
  7. ...
  8. $ ls -al /dev/sdb1
  9. brw-rw---- 1 root disk 8, 17 Oct 24 11:22 /dev/sdb1
  10. $ rm -f test.dat && dd if=/dev/zero of=test.dat
  11. ^C9912890+0 records in
  12. 9912890+0 records out
  13. 5075399680 bytes (5.1 GB) copied, 26.8189 s, 189 MB/s

This terminal will simulate the file write, at the same time another terminal will check which process is doing this. Here we can find the major/minor of the device is 8/17.

  1. $ stat -c '%i' test.dat
  2. 25337884
  3. $ sudo stap /usr/local/share/doc/systemtap/examples/io/inodewatch.stp 8 17 25337884
  4. dd(740) vfs_write 0x800011/25337884
  5. dd(740) vfs_write 0x800011/25337884
  6. dd(740) vfs_write 0x800011/25337884
  7. dd(740) vfs_write 0x800011/25337884
  8. dd(740) vfs_write 0x800011/25337884
  9. dd(740) vfs_write 0x800011/25337884
  10. ...

Have you noticed that dd is the process, PID is 740. It's done. Mission completed.

Source : http://blog.yufeng.info/archives/2581

LINUX PROCESS FILE WRITE

  RELATED

  COMMENTS

0

No comment for this article.