[linux] list processes using a file

processes use files and directories. you might need to know which process is using a file because it's locked the file/dir and you can't modify it, so you'll have to kill the process and edit your file. at least this was my case.

lsof +D <path>
e.g.

$ sudo lsof +D /var/log
COMMAND      PID   USER   FD   TYPE DEVICE SIZE/OFF    NODE NAME
systemd-j    539   root  mem    REG  253,0  8388608 3672301 /var/log/journal/ed214fcf933346b68d6hh6f76a18d552/user-1000.journal
systemd-j    539   root  mem    REG  253,0 58720256 3670236 /var/log/journal/ed214fcf933346b68d6hh6f76a18d552/system.journal
systemd-j    539   root  mem    REG  253,0  8388608 3670937 /var/log/journal/ed214fcf933346b68d6hh6f76a18d552/user-1000@4f8a576fe5f642e1a7f84f8f18d31870-0000000000000d26-00061de5aff72efd.journal
systemd-j    539   root   32u   REG  253,0 58720256 3670236 /var/log/journal/ed214fcf933346b68d6hh6f76a18d552/system.journal
systemd-j    539   root   38u   REG  253,0  8388608 3672301 /var/log/journal/ed214fcf933346b68d6hh6f76a18d552/user-1000.journal
vmtoolsd     818   root    3w   REG  253,0     1969 3670068 /var/log/vmware-vmsvc-root.log
rsyslogd     868 syslog    7w   REG  253,0 15700152 3671420 /var/log/syslog
rsyslogd     868 syslog    8w   REG  253,0  3626629 3671459 /var/log/kern.log
rsyslogd     868 syslog    9w   REG  253,0   253306 3671524 /var/log/auth.log
unattende    944   root    3w   REG  253,0        0 3692387 /var/log/unattended-upgrades/unattended-upgrades-shutdown.log

you can see the file name, process command and PID, and the user that has started the process. from here you can use top (or alternatives, htop etc.) to move on and inspect what's going on.