Find Which Process Is Writing to a File on Linux

A log file keeps growing, or a device cannot be unmounted, and you want to know which process has it open.

bash -c 'exec 3>> out.log; exec sleep 30' &
sleep 1
fuser -v out.log 2>&1
lsof out.log
kill $!

                     USER        PID ACCESS COMMAND
/tmp/run/S1884-1/w/out.log:
                     root       2706 F.... sleep
COMMAND  PID USER   FD   TYPE DEVICE SIZE/OFF    NODE NAME
sleep   2706 root    3w   REG  0,185        0 3027768 out.log

fuser -v out.log lists the processes that use the file, with the user, the PID and an access code, where F means open for writing and a plain f open for reading. lsof out.log gives the same answer in a table that adds the descriptor, 3w, the type and the inode. Both read the process table through /proc, where /proc/PID/fd lists the open files of each process. See proc_pid_fd.

Without root you only see your own processes. The answer is about now, so a program that opened the file, wrote and closed it is not listed. fuser -k kills what it finds, so run it without -k first. A file that was deleted while open is only found through its descriptor, not its name.