tracking what files are being accessed by a process?

[Christopher Browne]

On Mon, Jan 7, 2013 at 12:51 PM, Matt Price <moptop99-Re5JQEeQqe8AvxtiuMwx3w at public.gmane.org> wrote:
> On Mon, Jan 7, 2013 at 12:20 PM, Matt Price <moptop99-Re5JQEeQqe8AvxtiuMwx3w at public.gmane.org> wrote:
>> On Mon, Jan 7, 2013 at 10:41 AM, Christopher Browne <cbbrowne-Re5JQEeQqe8AvxtiuMwx3w at public.gmane.org> wrote:
>>> On Mon, Jan 7, 2013 at 10:24 AM, Matt Price <moptop99-Re5JQEeQqe8AvxtiuMwx3w at public.gmane.org> wrote:
>>>> hey folks,
>>>>
>>>> I'm having a trouble with skype on my ubuntu 12.10 laptop -- it
>>>> monopolizes the disk with very heavy reads, and my system grinds to a
>>>> halt.
>>>>
>>>> I'd like to at least check to see what it's reading, before I give up
>>>> and stop using it; is there a simple way to do this?  thanks,
>>>> Matt
>>>
>>> The usual tools used for this are lsof and fuser, which have somewhat
>>> different user
>>> interfaces for determining processes associated with files.
>>>
>>> fuser is in the package "psmisc"
>>>
>>> lsof is in the package "lsof"
>>>
>>> Alternatively, you can figure quite a bit out from what's found in /proc
>>>
>>> Here's the file listing for the instance of firefox that I have running:
>>>
>>> cbbrowne at cbbrowne /proc/30090/fd> ps auxww | grep firefox/firefox
>>> cbbrowne 30090 15.6  7.0 809344 278864 pts/1   SNl  10:32   1:12
>>> /home/cbbrowne/firefox/firefox
>>> cbbrowne 30614  0.0  0.0   6304   604 pts/1    S+   10:39   0:00 grep
>>> firefox/firefox
>>> cbbrowne at cbbrowne /proc/30090/fd> cd
>>> cbbrowne at cbbrowne ~> ps auxww | grep firefox/firefox
>>> cbbrowne 30090 15.4  7.0 809408 279064 pts/1   SNl  10:32   1:12
>>> /home/cbbrowne/firefox/firefox
>>> cbbrowne 30632  0.0  0.0   6304   604 pts/1    S+   10:39   0:00 grep
>>> firefox/firefox
>>> cbbrowne at cbbrowne ~> cd /proc/30090/fd
>>> cbbrowne at cbbrowne /proc/30090/fd> ls -l
>
>>> Do similar for skype, and you should get some more or less interesting
>>> information.
>>> --
>>
>> huh, that does seem intresting.  In particular, skype seems to be
>> going through all the files in my .mozilla/firefox profile, espeially
>> the zotero storage directory, which is rather large.  hmm. I don't
>> really like that at all!  not sure though what  I can do to stop it,
>> or why it would ever happen in the first place!
>
> just for the archive:  I solved this using the apparmor profile pasted here:
> http://pastebin.com/raw.php?i=b1dicunW

Interesting...  So, AppArmor is something like FILDAE?  (The TOPS-20
file access control daemon
<http://pdp-10.trailing-edge.com/bb-d549g-sb/01/fildae.doc.html>)
-- 
When confronted by a difficult problem, solve it by reducing it to the
question, "How would the Lone Ranger handle this?"
--
The Toronto Linux Users Group.      Meetings: http://gtalug.org/
TLUG requests: Linux topics, No HTML, wrap text below 80 columns
How to UNSUBSCRIBE: http://gtalug.org/wiki/Mailing_lists