Finding the Process That Writes a File on CentOS 7 with SystemTap
This guide explains how to monitor disk usage on a CentOS 7 server, generate periodic snapshots with iostat, sar, and pidstat, schedule them via at, and ultimately locate the exact process writing to a specific file by extracting its inode and tracing it with SystemTap’s inodewatch script, handling kernel‑devel and debuginfo requirements.
