Quick howto on finding the list of files being accessed by a process in Linux. I needed to find this for troubleshooting an issue where a particular process was using an abnormally high percentage of CPU. I wanted to find out what this particular process was doing and accessing.
- Find the process ID (pid) of the process you want to analyze by running[code] ps -ef | grep NAME_OF_PROCESS [/code]
- Find the files the process is accessing at a given time by running[code]sudo ls -l /proc/PROCESS_ID/fd [/code]
For example, if I wanted to find the list of files being accessed by mysql, the process would look as such
[code] ps -ef | grep mysqld [/code]
which would show the output as
[code]samurai@samurai:~$ ps -ef | grep mysqld
mysql 3304 1 0 Feb04 ? 00:00:23 /usr/sbin/mysqld
samurai 23389 23374 0 14:57 pts/0 00:00:00 grep –color=auto mysqld
[/code]
I can then find the list of files being used by mysql by running
[code] sudo ls -l /proc/3304/fd [/code]
which would give me
[code]
lrwx—— 1 root root 64 Feb 7 15:00 0 -> /dev/null
lrwx—— 1 root root 64 Feb 7 15:00 1 -> /var/log/mysql/error.log
lrwx—— 1 root root 64 Feb 7 15:00 10 -> socket:[4958]
lrwx—— 1 root root 64 Feb 7 15:00 11 -> /tmp/ibdu9WRh (deleted)
lrwx—— 1 root root 64 Feb 7 15:00 12 -> socket:[4959]
lrwx—— 1 root root 64 Feb 7 15:00 14 -> /var/lib/mysql/blog/wp_term_relatio nships.MYI
lrwx—— 1 root root 64 Feb 7 15:00 15 -> /var/lib/mysql/blog/wp_postmeta.MYI
lrwx—— 1 root root 64 Feb 7 15:00 17 -> /var/lib/mysql/blog/wp_term_relatio nships.MYD
lrwx—— 1 root root 64 Feb 7 15:00 18 -> /var/lib/mysql/blog/wp_term_taxonom y.MYI
lrwx—— 1 root root 64 Feb 7 15:00 2 -> /var/log/mysql/error.log
lrwx—— 1 root root 64 Feb 7 15:00 20 -> /var/lib/mysql/blog/wp_postmeta.MYD
lrwx—— 1 root root 64 Feb 7 15:00 21 -> /var/lib/mysql/blog/wp_term_taxonom y.MYD
lrwx—— 1 root root 64 Feb 7 15:00 22 -> /var/lib/mysql/blog/wp_terms.MYI
lrwx—— 1 root root 64 Feb 7 15:00 23 -> /var/lib/mysql/blog/wp_terms.MYD
lrwx—— 1 root root 64 Feb 7 15:00 3 -> /var/lib/mysql/ibdata1
lrwx—— 1 root root 64 Feb 7 15:00 4 -> /tmp/ibvANyz7 (deleted)
lrwx—— 1 root root 64 Feb 7 15:00 5 -> /tmp/ibonS0mU (deleted)
lrwx—— 1 root root 64 Feb 7 15:00 6 -> /tmp/ibcKctaH (deleted)
lrwx—— 1 root root 64 Feb 7 15:00 7 -> /tmp/ibB5DS5t (deleted)
lrwx—— 1 root root 64 Feb 7 15:00 8 -> /var/lib/mysql/ib_logfile0
lrwx—— 1 root root 64 Feb 7 15:00 9 -> /var/lib/mysql/ib_logfile1
[/code]