2

I'm watching which files / directories are being written to on my Ubuntu 22.04.1 LTS installation (kernel v. 5.15.0-52-generic).

Suddenly I'm seeing writes to /proc/85/root/tty every 1 second.
I know this may be some specific process (such as firefox) to my machine.

If so, can you tell me how I can determine which process it would be that is writing to this tty?

andrew.46
  • 39,359
raddevus
  • 1,998

1 Answers1

5

/proc/85 is for PID 85. To find out the process or program name do ps aux | grep " 85 ". Example from my computer, but for the similar PID 86:

doug@s19:~/idle/teo/util/ping-sweep/6-2$ ps aux | grep " 86 "
root          86  0.0  0.0      0     0 ?        S    Oct26   0:00 [kdevtmpfs]
doug       13416  0.0  0.0   9040   660 pts/2    S+   13:44   0:00 grep --color=auto  86

Where the 2nd hit is the grep program itself. So the kernel thread that maintains devtmpfs is what you are observing. I do not know why you see the tty handle being written to every second. On my system it seems to update not often, and I haven't been able to isolate why:

doug@s19:~$ sudo ls -l /proc/86/root/tty
crw-rw-rw- 1 root tty 5, 0 Oct 28 13:34 /proc/86/root/tty
doug@s19:~$ sudo ls -l /proc/86/root/tty
crw-rw-rw- 1 root tty 5, 0 Oct 28 13:34 /proc/86/root/tty
doug@s19:~$ sudo ls -l /proc/86/root/tty
crw-rw-rw- 1 root tty 5, 0 Oct 28  2022 /proc/86/root/tty
doug@s19:~$ sudo ls -l /proc/86/root/tty
crw-rw-rw- 1 root tty 5, 0 Oct 28 13:58 /proc/86/root/tty
doug@s19:~/idle/teo/util/ping-sweep/6-2$ date
Fri 28 Oct 2022 02:05:07 PM PDT
doug@s19:~$ sudo ls -l /proc/86/root/tty
crw-rw-rw- 1 root tty 5, 0 Oct 28 13:58 /proc/86/root/tty
Doug Smythies
  • 16,146