Find the writing process
iotop -o -P -a
simple top-like I/O monitor
-o, --only
Only show processes or threads actually doing I/O, instead of showing all processes or threads.
This can be dynamically toggled by pressing o.
-P, --processes
Only show processes. Normally iotop shows all threads.
-a, --accumulated
Show accumulated I/O instead of bandwidth. In this mode, iotop shows the amount of I/O processes
have done since iotop started.
Wait for a fixed time period and order the results by "DISK WRITE>"
Total DISK READ : 0.00 B/s | Total DISK WRITE : 39.48 K/s
Actual DISK READ: 0.00 B/s | Actual DISK WRITE: 0.00 B/s
PID PRIO USER DISK READ DISK WRITE> SWAPIN IO COMMAND
12345 be/4 root 0.00 B 124.00 K 0.00 % 0.00 % python server.py
12346 be/4 root 0.00 B 100.00 K 0.00 % 0.00 % python server.py
Find the output files of the process
lsof -p 12345 | grep 'w\s*REG'
list open files
-p s This option excludes or selects the listing of files for the processes whose optional process
IDentification (PID) numbers are in the comma-separated set s - e.g., ``123'' or ``123,^456''.
(There should be no spaces in the set.)
PID numbers that begin with `^' (negation) represent exclusions.
Multiple process ID numbers are joined in a single ORed set before participating in AND option
selection. However, PID exclusions are applied without ORing or ANDing and take effect before
other selection criteria are applied.
Filters results for process 12345 and grep is looking for regular files in write mode.
Most probably you will encounter some kind of log file.
python 17716 root 229w REG 253,3 4688389990 79091521 /net.log
The path is relative to the process and its scope! For example if the process is within a running docker container you have to docker exec into it to actually see the files.