How to find out open file?

[kadnan]

salam after long time!


is there any way to find out whether some "xyz" file is opened by some user? I tried lsof command but it's not doing what I want. I opened a file in gEdit and then try to catch its entry in lsof, i didn't find at all.

Also i tell that I would be accessing file via SAMBA on windows so if Samba provides some facility then please do tell me.

[lambda]

lsof shows you if some process has a file descriptor ("handle") for a file. gedit probably opens the file, reads the contents, and then closes it; that's why it doesn't show up in lsof. if you try another editor, like vi, you'll see that it keeps file descriptor to the file while the editor is running.

i think if you turn up the debugging output for samba, it'll show you the names of files accessed in the log files.

another option is inotify. i don't know if the inotify tools (inotifywatch, etc) can show you the username of someone accessing the file, but you can write an app using the python or ruby inotify api to do what you want.

[lambda]

in fact...

Code: Select all

#!/usr/bin/env python
"""Watch a file or multiple files for certain events."""

import os, os.path
import sys

from pyinotify import ProcessEvent, WatchManager, Notifier, EventsCodes


class PEvent(ProcessEvent):
    """Do something with events."""

    def process_IN_OPEN(self, event):
        """Someone opened a watched file."""

        print 'open', event.path
        os.system('lsof %s 2>/dev/null' % event.path)

    def process_IN_CLOSE_WRITE(self, event):
        """Someone closed a watched file."""

        print 'close', event.path

    def process_IN_CLOSE_NOWRITE(self, event):
        """Someone closed a watched file."""

        print 'close', event.path

    def process_IN_MODIFY(self, event):
        """Someone modified a watched file."""

        print 'modify', event.path
        os.system('lsof %s 2>/dev/null' % event.path)


def usage():
    """Show usage statement."""

    sys.stderr.write('''\
usage: %s filetowatch [file2 file3 ...]
''' % sys.argv[0].split('/')[-1])
    sys.exit(1)


def watch(fnames):
    """Loop forever, watching files."""

    events = EventsCodes.IN_OPEN | EventsCodes.IN_CLOSE_WRITE | \
        EventsCodes.IN_CLOSE_NOWRITE | EventsCodes.IN_MODIFY
    manager = WatchManager()
    notifier = Notifier(manager, PEvent())

    for fname in fnames:
        manager.add_watch(fname, events)
    print 'watching', ' '.join(fnames)

    while True:
        try:
            notifier.process_events()
            if notifier.check_events():
                notifier.read_events()
        except KeyboardInterrupt:
            print 'ending'
            notifier.stop()
            break
        except Exception, err:
            print err


def main(fnames):
    """Main branching logic."""

    if len(fnames) == 0:
        usage()

    # which of the provided filenames actually exist?
    goodfnames = []
    for fname in fnames:
        if os.path.exists(fname):
            goodfnames.append(fname)

    watch(goodfnames)


if __name__ == '__main__':
    main(sys.argv[1:])