How can you identify files that are currently being read by a process in Linux?

In Linux, you can identify files that are currently being read by a process using the /proc directory. Each process has a folder /proc/<pid>/fd/, where <pid> is the process ID. Inside this folder are symbolic links to the files opened by the process.

To see which files are open by a process, you can run:

ls -l /proc/<pid>/fd/

To filter files that are specifically being read, you can use lsof (list open files) with process filtering:

lsof -p <pid>

In the lsof output, the FD (file descriptor) column has suffixes:

• r — file is open for reading
• w — file is open for writing
• u — file is open for reading and writing

Thus, files with r or u in this column are being read by the process.

Example:

lsof -p 1234 | grep 'r'

This will show files that the process with PID 1234 is reading.