Linux – How to Find Out Which File Is Currently Written by a Process

fileslinuxopen files

My situation is that from time to time a specific process (in this case, it's Thunderbird) doesn't react to user input for a minute or so. I found out using iotop that during this time, it writes quite a lot to the disk, and now I want to find out which file it writes to, but unfortunately iotop gives only stats per process and not per open file(-descriptor).

I know that I can use lsof to find out which files the process has currently open, but of course Thunderbird has a lot of them open, so this is not that helpful. iostat only shows statistics per device.

The problem occurs only randomly and it might take quite some time for it to appear, so I hope I don't have to strace Thunderbird and wade through long logs to find out which file has the most writes.

Best Answer

If you attach strace to the process just when it's hung (you can get the pid and queue the command up in advance, in a spare terminal), it'll show the file descriptor of the blocking write.

Trivial example:

$ mkfifo tmp
$ cat /dev/urandom > tmp &
[1] 636226
  # this will block on open until someone opens for reading

$ exec 4<tmp
  # now it should be blocked trying to write

$ strace -p 636226
Process 636226 attached - interrupt to quit
write(1, "L!\f\335\330\27\374\360\212\244c\326\0\356j\374`\310C\30Z\362W\307\365Rv\244?o\225N"..., 4096 <unfinished ...>
^C
Process 636226 detached

Related Solutions

How to Determine Processes Using Entropy from /dev/urandom

The short answer is 0, because entropy is not consumed.

There is a common misconception that entropy is consumed — that each time you read a random bit, this removes some entropy from the random source. This is wrong. You do not “consume” entropy. Yes, the Linux documentation gets it wrong.

During the life cycle of a Linux system, there are two stages:

Initially, there is not enough entropy. /dev/random will block until it thinks it has amassed enough entropy; /dev/urandom happily provides low-entropy data.
After a while, enough entropy is present in the random generator pool. /dev/random assigns a bogus rate of “entropy leek” and blocks now and then; /dev/urandom happily provides crypto-quality random data.

FreeBSD gets it right: on FreeBSD, /dev/random (or /dev/urandom, which is the same thing) blocks if it doesn't have enough entropy, and once it does, it keeps spewing out random data. On Linux, neither /dev/random nor /dev/urandom is the useful thing.

In practice, use /dev/urandom, and make sure when you provision your system that the entropy pool is fed (from disk, network and mouse activity, from a hardware source, from an external machine, …).

While you could try to read how many bytes get read from /dev/urandom, this is completely pointless. Reading from /dev/urandom does not deplete the entropy pool. Each consumer uses up 0 bits of entropy per any unit of time you care to name.

Linux – Find processes which have a file open without lsof or fuser

Use /proc/<PID>/fd.

Example....we want to figure out which pid has /var/log/audit/audit.log open. fuser tells us it's pid 255.

[root@instance-1 ~]# fuser /var/log/audit/audit.log
/var/log/audit/audit.log:   255
[root@instance-1 ~]#

So using a non fuser solution:

[root@instance-1 ~]# find /proc/*/fd -ls|grep /var/log/audit/audit.log
188652    0 l-wx------   1 root     root           64 Jul  1 06:22 /proc/255/fd/5 -> /var/log/audit/audit.log
[root@instance-1 ~]#

Best Answer

Related Solutions

How to Determine Processes Using Entropy from /dev/urandom

Linux – Find processes which have a file open without lsof or fuser

Related Question