How to know when a file is opened by the system, not by an user

[Rafael Moran_1]

Hello All,

I would like to know how can I be sure that a file is being used by the system.
Example: The system is generating a file but due to a high workload this file is not being actualized in 2 minutes. Externally it seems that the file system has finish because the file has no activity in 2 minutes but it is still opened to add more info when it is ready

Thank you in advanced

[Stefan Farrelly · Accepted solution]

I think youre going to have to use lsof. Download and install it.

Then, run lsof -ou to see all the users open files, then grep the file in question, and watch the offset field. If the file is being written to the offset number keeps changing. If the offset value stays stagnant for a while then the file is not being written to.

[Santosh Nair_1]

I'm not sure I understand your question, but here goes.

fuser will show you who has the file open, but I don't know that there is a way to detect whether there are any pending writes to the file. If the load is high on the system and the process has not gotten to the point of writing to the file, there is not way to detect that short of tracing the system calls made by the process (using tusc or the like).

-Santosh

[Frank Slootweg]

Adding to the other responses:

It is also important to realize that many programs will use stdio(3S) routines, i.e. printf(3S) etc., to do the writing. stdio to a file is normally buffered. The standard buffer size (see BUFSIZ in setbuf(3S)) is 1024 bytes, i.e. unless/until the application has written 1024 bytes, the disk file will not be changed/written_to.

[Rafael Moran_1]

Thank you all,

I tried first with the lsof with that example:

I edited with vi a file called nohup.out
Then I did lsof | grep nohup but nothing appeared
Also I tried with lsof -ou root |grep nohup but same result
I'm still reading at the lsof man(was a new instruction for me)

With fuser same result, it doesn't show the file as used.

[David Lodge]

Expirementing with vi won't show anything, the first thing vi/ex/ed does is copy the file (to /var/tmp IIRC) and edits that, it only opens the real file to save/load.

dave

[Wodisch]

Hello Rafael,

if you do know the process having open that file, then the easiest answer seems to be GlancePlus: select that process, go for the "Open Files", and watch it until it vanishes from there (or the process dies).

Just my $0.02,
Wodisch