processes use files and directories. you might need to know which process is using a file because it's locked the file/dir and you can't modify it, so you'll have to kill the process and edit your file. at least this was my case.
lsof +D <path>
e.g.
$ sudo lsof +D /var/log
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
systemd-j 539 root mem REG 253,0 8388608 3672301 /var/log/journal/ed214fcf933346b68d6hh6f76a18d552/user-1000.journal
systemd-j 539 root mem REG 253,0 58720256 3670236 /var/log/journal/ed214fcf933346b68d6hh6f76a18d552/system.journal
systemd-j 539 root mem REG 253,0 8388608 3670937 /var/log/journal/ed214fcf933346b68d6hh6f76a18d552/user-1000@4f8a576fe5f642e1a7f84f8f18d31870-0000000000000d26-00061de5aff72efd.journal
systemd-j 539 root 32u REG 253,0 58720256 3670236 /var/log/journal/ed214fcf933346b68d6hh6f76a18d552/system.journal
systemd-j 539 root 38u REG 253,0 8388608 3672301 /var/log/journal/ed214fcf933346b68d6hh6f76a18d552/user-1000.journal
vmtoolsd 818 root 3w REG 253,0 1969 3670068 /var/log/vmware-vmsvc-root.log
rsyslogd 868 syslog 7w REG 253,0 15700152 3671420 /var/log/syslog
rsyslogd 868 syslog 8w REG 253,0 3626629 3671459 /var/log/kern.log
rsyslogd 868 syslog 9w REG 253,0 253306 3671524 /var/log/auth.log
unattende 944 root 3w REG 253,0 0 3692387 /var/log/unattended-upgrades/unattended-upgrades-shutdown.log
you can see the file name, process command and PID, and the user that has started the process. from here you can use top (or alternatives, htop etc.) to move on and inspect what's going on.
Top comments (0)