Quick howto on finding the list of files being accessed by a process in Linux. I needed to find this for troubleshooting an issue where a particular process was using an abnormally high percentage of CPU. I wanted to find out what this particular process was doing and accessing.
- Find the process ID (pid) of the process you want to analyze by running
ps -ef | grep NAME_OF_PROCESS
- Find the files the process is accessing at a given time by running
sudo ls -l /proc/PROCESS_ID/fd
For example, if I wanted to find the list of files being accessed by mysql, the process would look as such
ps -ef | grep mysqld
which would show the output as
samurai@samurai:~$ ps -ef | grep mysqld mysql 3304 1 0 Feb04 ? 00:00:23 /usr/sbin/mysqld samurai 23389 23374 0 14:57 pts/0 00:00:00 grep --color=auto mysqld
I can then find the list of files being used by mysql by running
sudo ls -l /proc/3304/fd
which would give me
lrwx------ 1 root root 64 Feb 7 15:00 0 -> /dev/null lrwx------ 1 root root 64 Feb 7 15:00 1 -> /var/log/mysql/error.log lrwx------ 1 root root 64 Feb 7 15:00 10 -> socket:[4958] lrwx------ 1 root root 64 Feb 7 15:00 11 -> /tmp/ibdu9WRh (deleted) lrwx------ 1 root root 64 Feb 7 15:00 12 -> socket:[4959] lrwx------ 1 root root 64 Feb 7 15:00 14 -> /var/lib/mysql/blog/wp_term_relatio nships.MYI lrwx------ 1 root root 64 Feb 7 15:00 15 -> /var/lib/mysql/blog/wp_postmeta.MYI lrwx------ 1 root root 64 Feb 7 15:00 17 -> /var/lib/mysql/blog/wp_term_relatio nships.MYD lrwx------ 1 root root 64 Feb 7 15:00 18 -> /var/lib/mysql/blog/wp_term_taxonom y.MYI lrwx------ 1 root root 64 Feb 7 15:00 2 -> /var/log/mysql/error.log lrwx------ 1 root root 64 Feb 7 15:00 20 -> /var/lib/mysql/blog/wp_postmeta.MYD lrwx------ 1 root root 64 Feb 7 15:00 21 -> /var/lib/mysql/blog/wp_term_taxonom y.MYD lrwx------ 1 root root 64 Feb 7 15:00 22 -> /var/lib/mysql/blog/wp_terms.MYI lrwx------ 1 root root 64 Feb 7 15:00 23 -> /var/lib/mysql/blog/wp_terms.MYD lrwx------ 1 root root 64 Feb 7 15:00 3 -> /var/lib/mysql/ibdata1 lrwx------ 1 root root 64 Feb 7 15:00 4 -> /tmp/ibvANyz7 (deleted) lrwx------ 1 root root 64 Feb 7 15:00 5 -> /tmp/ibonS0mU (deleted) lrwx------ 1 root root 64 Feb 7 15:00 6 -> /tmp/ibcKctaH (deleted) lrwx------ 1 root root 64 Feb 7 15:00 7 -> /tmp/ibB5DS5t (deleted) lrwx------ 1 root root 64 Feb 7 15:00 8 -> /var/lib/mysql/ib_logfile0 lrwx------ 1 root root 64 Feb 7 15:00 9 -> /var/lib/mysql/ib_logfile1