What script/user/process is writing to a file? - linux

Question

I'm trying to find out what script/user/process is writing to a file .
I have 4 hosts that have the same NFS mounted
I have made a scipt and put it on all of the host and with no success
Can sombody please help with this
The script is running from 5:50 to 6:10 this is the period when the my file gets written to
This is the script that I made :
#!/bin/sh
log=~/file-access.log
check_time_to_run() {
tempTime=$1
if [ $tempTime -gt 555 -a $tempTime -lt 610 ]; then
#Intre intervalul 5:55 si 6:10
lsof /cdpool/Xprint/Liste_Drucker >> $log
else
#In afara intervalului
exit 1
fi
}
while true; do
currTime=`date +%k%M`
check_time_to_run $currTime
sleep 0.1s
done

Answer 1

Don't use a shell script for this at all. Instead, install sysdig, and run:
sysdig 'fd.filename=/cdpool/Xprint/Liste_Drucker'
...leave that open, and whenever anything writes to or reads from that file, an appropriate log message will be printed.
If you want to print both the username and the process name (with arguments) for the job printing to the file, the following format string will do so:
sysdig \
-p '%user.name %proc.name - %evt.dir %evt.type %evt.args' \
'fd.filename=/cdpool/Xprint/Liste_Drucker'