Find the writing process

iotop -o -P -a
simple top-like I/O monitor
-o, --only
       Only  show  processes  or threads actually doing I/O, instead of showing all processes or threads.
       This can be dynamically toggled by pressing o.
-P, --processes
       Only show processes. Normally iotop shows all threads.
-a, --accumulated
       Show accumulated I/O instead of bandwidth. In this mode, iotop shows the amount of  I/O  processes
       have done since iotop started.

 

Wait for a fixed time period and order the results by "DISK WRITE>"

Total DISK READ : 0.00 B/s | Total DISK WRITE :    39.48 K/s
Actual DISK READ: 0.00 B/s | Actual DISK WRITE:       0.00 B/s
  PID  PRIO  USER     DISK READ DISK WRITE>  SWAPIN      IO    COMMAND
12345 be/4 root          0.00 B    124.00 K  0.00 %  0.00 % python server.py
12346 be/4 root          0.00 B    100.00 K  0.00 %  0.00 % python server.py


Find the output files of the process

lsof -p 12345 | grep 'w\s*REG'
list open files
-p s     This option excludes or selects the listing of files for the processes  whose  optional  process
         IDentification  (PID)  numbers are in the comma-separated set s - e.g., ``123'' or ``123,^456''.
         (There should be no spaces in the set.)
         PID numbers that begin with `^' (negation) represent exclusions.
         Multiple process ID numbers are joined in a single ORed set before participating in  AND  option
         selection.   However,  PID exclusions are applied without ORing or ANDing and take effect before
         other selection criteria are applied.

 

Filters results for process 12345 and grep is looking for regular files in write mode.

Most probably you will encounter some kind of log file.

python  17716 root  229w      REG              253,3 4688389990  79091521 /net.log

The path is relative to the process and its scope! For example if the process is within a running docker container you have to docker exec into it to actually see the files.