2

I'm watching which files / directories are being written to on my Ubuntu 22.04.1 LTS installation (kernel v. 5.15.0-52-generic).

Suddenly I'm seeing writes to /proc/85/root/tty every 1 second.
I know this may be some specific process (such as firefox) to my machine.

If so, can you tell me how I can determine which process it would be that is writing to this tty?

andrew.46
  • 37,085
  • 25
  • 149
  • 228
raddevus
  • 1,728
  • 1
  • 13
  • 23
  • 2
    what do you get for `ps aux | grep " 85 "` – Doug Smythies Oct 28 '22 at 18:42
  • I get : root 85 0.0 0.0 0 0 ? S 07:38 0:00 [kdevtmpfs] I had tried ps -al but didn't see one with PID 85. Interesting. – raddevus Oct 28 '22 at 18:46
  • 2
    O.K., for me [kdevtmpfs] is process ID 86, and `/proc/86/root/tty` hasn't been written to for over 5 minutes now. – Doug Smythies Oct 28 '22 at 19:02
  • Thanks for showing me how to discover that process. That was part of the question so if you post an official answer I will upvote you. – raddevus Oct 28 '22 at 19:16
  • I have removed the links in your question which the community has flagged as spam. Have a look here: https://askubuntu.com/help/promotion – andrew.46 Oct 28 '22 at 23:25
  • @andrew.46 No problem. It wasn't spam, it was to show why I was asking the question and how I knew the target was being written to every second. Also there was no benefit to me at all by adding the links - the source is fully open source. – raddevus Oct 29 '22 at 03:31

1 Answers1

5

/proc/85 is for PID 85. To find out the process or program name do ps aux | grep " 85 ". Example from my computer, but for the similar PID 86:

doug@s19:~/idle/teo/util/ping-sweep/6-2$ ps aux | grep " 86 "
root          86  0.0  0.0      0     0 ?        S    Oct26   0:00 [kdevtmpfs]
doug       13416  0.0  0.0   9040   660 pts/2    S+   13:44   0:00 grep --color=auto  86

Where the 2nd hit is the grep program itself. So the kernel thread that maintains devtmpfs is what you are observing. I do not know why you see the tty handle being written to every second. On my system it seems to update not often, and I haven't been able to isolate why:

doug@s19:~$ sudo ls -l /proc/86/root/tty
crw-rw-rw- 1 root tty 5, 0 Oct 28 13:34 /proc/86/root/tty
doug@s19:~$ sudo ls -l /proc/86/root/tty
crw-rw-rw- 1 root tty 5, 0 Oct 28 13:34 /proc/86/root/tty
doug@s19:~$ sudo ls -l /proc/86/root/tty
crw-rw-rw- 1 root tty 5, 0 Oct 28  2022 /proc/86/root/tty
doug@s19:~$ sudo ls -l /proc/86/root/tty
crw-rw-rw- 1 root tty 5, 0 Oct 28 13:58 /proc/86/root/tty
doug@s19:~/idle/teo/util/ping-sweep/6-2$ date
Fri 28 Oct 2022 02:05:07 PM PDT
doug@s19:~$ sudo ls -l /proc/86/root/tty
crw-rw-rw- 1 root tty 5, 0 Oct 28 13:58 /proc/86/root/tty
Doug Smythies
  • 14,898
  • 5
  • 40
  • 57