You can leverage `lsof` tool to list all opened files, then use `ps` to see the details about the process that file opened. ``` admin@i-03624a0ebe0294fc4:~$ lsof | grep bad.log badlog.py 592 admin 3w REG 259,1 38654 265802 /var/log/bad.log ``` See more details about process with PID **592**. ``` admin@i-03624a0ebe0294fc4:~$ ps waux | grep 592 admin 592 0.0 1.7 12508 8276 ? S 09:31 0:00 /usr/bin/python3 /home/admin/badlog.py ``` ### See also 1. [[What is process in Linux?]] ### Reference 1.