How to see which file are in use in Linux

Question

I have a question how can I see which file are in use in linux. To be honest this OS is not the normal version of linux it is very crippled so for example there is no command like "lsof". I found command "strace" but this is no what I looking for. I hear that I can list this file with hacking kernel?

I want to see which file are in use because on this machine is a little free space and I want to delete file which are no in use when the program is running.

I'm sorry for my weak english.

Answer 1

You can inspect the open files by process by walking the /proc virtual filesystem

Every process running has an entry in /proc/PID. There's a directory in each process directory called 'fd', that represents the processes currently opened file descriptors . These appear as links to the actual resources.

eg on a VM I have running

root@wvm:/proc/1213/fd# pidof dhclient
1213
root@wvm:/proc/1213/fd# cd /proc/1213/fd
root@wvm:/proc/1213/fd# ls -l
total 0
lrwx------ 1 root root 64 Apr  8 09:11 0 -> /dev/null
lrwx------ 1 root root 64 Apr  8 09:11 1 -> /dev/null
lrwx------ 1 root root 64 Apr  8 09:11 2 -> /dev/null
lrwx------ 1 root root 64 Apr  8 09:11 20 -> socket:[4687]
lrwx------ 1 root root 64 Apr  8 09:11 21 -> socket:[4688]
l-wx------ 1 root root 64 Apr  8 09:11 3 -> /var/lib/dhcp/dhclient.eth0.leases
lrwx------ 1 root root 64 Apr  8 09:11 4 -> socket:[4694]
lrwx------ 1 root root 64 Apr  8 09:11 5 -> socket:[4698]
root@wvm:/proc/1213/fd#

Looking at the kernel process information for 'dhclient' - I find its pid, and then look in the fd subdirectory for this process id. It has a small set of open descriptors - stdin, stdout and stderr ( 0,1,2 ) have all been attached to /dev/null , there's four sockets open, but file descriptor 3 is attached to a data file /var/lib/dhcp/dhclient.eth0.leases

So you could duplicate the functionality of lsof using shell tools to walk /proc and filter out the file names from these links.

Answer 2

Are you able to use "top" command? if so then this should show you the list of all the top OS utilizing operations running on linux. You can do

ps -ef|grep <process_no>  

this would give the details of it. Either can stop that process or kill it using

kill -9 <process no>

Answer 3

Use the lsof command to list all open files by process.