lsof for a specific process?

Question

There's a bzip2 process running in the background and I have no idea where it came from. It's eating up a lot of resources. Can I do a reverse lsof to see which files are being accessed by this process?

I've suspended the process for the time being.

Solution 1

I'm not sure why that'd be a "reverse lsof" -- lsof does exactly that. You can pass it the -p flag to specify which PIDs to include/exclude in the results:

$ lsof -p $(pidof bzip2)

Solution 2

In the /proc/ directory you can find details of the running processes, in separate directories, by their PID. Their file descriptors are enumerated in the fd/ sub-directory:

ls -l /proc/$(pidof -s bzip2)/fd/

Comments

[Gilles 'SO- stop being evil']

Reverse from lsof /path/to/file (which I guess is the mode of operation Pieter is used to).

[wchargin]

Note that if you have existing filters to lsof, you can use -a to AND them instead of ORing them: lsof -a -i TCP -p 12345.