A function I keep in my .bashrc for quickly finding what files a process has open.

openfiles.sh

function openfiles {
    if [ "${1}" = "-h" ]; then
        echo -e "Usage: openfiles [r|w|m|R|W] regex\n    -r    opened for reading or read/write\n    -w    opened for writing or read/write\n    -m    accessed from memory (includes running command)\n    -R    opened for reading only\n    -W    opened for writing only"
        return
    fi
    if [ "$#" = "0" ]; then
        echo "Process signature/regex required."
        return
    fi
    MODE="(w|u)"
    ACTION="for writing"
    if [ "${1}" = "r" ]; then
        MODE="(r|u)"
        ACTION="for reading"
        shift
    elif [ "${1}" = "R" ]; then
        MODE="r"
        ACTION="for reading (only)"
        shift
    elif [ "${1}" = "W" ]; then
        MODE="w"
        ACTION="for writing (only)"
        shift
    elif [ "${1}" = "m" ]; then
        MODE="(txt|mem)"
        ACTION="in memory"
        shift
    elif [ "${1}" = "w" ]; then
        shift
    fi
    if [ "${MODE}" != "(txt|mem)" ]; then
        MODE="[0-9]+${MODE}"
    fi
    PIDS=$(pgrep -d "," -f "${@}")
    if [ "${PIDS}" = "" ]; then
        echo "No processes found matching '${@}'."
        return
    fi
    OPENFILES=$(sudo lsof -PXn -p ${PIDS} | egrep "${MODE}[A-Za-z]* +REG" | awk '{print $9}' | egrep -v "^\[" | sort | uniq);
    if [ "${OPENFILES}" = "" ]; then
        echo "No files opened ${ACTION}."
    else
        echo "Files opened ${ACTION}:"
        sudo ls -ahl $OPENFILES
    fi
}

Examples.md

Examples

$ openfiles -h
Usage: openfiles [r|w|R|W] regex

$ openfiles nginx
Files opened for writing:
-rw-r----- 1 nginx root  38G May  3 18:35 /data/nginx/stats.log
-rw-r----- 1 nginx root    0 Jan 13 03:06 /var/log/nginx/access.log
-rw-r----- 1 nginx root 154M May  3 18:35 /var/log/nginx/error.log

$ openfiles R nginx
No files opened for reading (only).