如何查找某个进程正在操作的文件？

Question

就我而言,它是"rsyslogd",

我发现它耗费高达170M的内存,这太多了,

我已经检查了位于/etc/rsyslog.conf的配置文件

然后检查里面写的每个文件,

但是徒劳无功

如何查找当前正在操作的文件并查看正在进行的操作？

[root@slvdb2 log]# lsof -p `pidof rsyslogd`
COMMAND   PID USER   FD   TYPE             DEVICE    SIZE       NODE NAME
rsyslogd 1965 root  cwd    DIR                8,1    4096          2 /
rsyslogd 1965 root  rtd    DIR                8,1    4096          2 /
rsyslogd 1965 root  txt    REG                8,1  259072    2818209 /sbin/rsyslogd
rsyslogd 1965 root  mem    REG                8,1  142176    1097807 /lib64/ld-2.8.so
rsyslogd 1965 root  mem    REG                8,1 1804136    1097817 /lib64/libc-2.8.so
rsyslogd 1965 root  mem    REG                8,1  143096    1097871 /lib64/libpthread-2.8.so
rsyslogd 1965 root  mem    REG                8,1   88976    1097890 /lib64/libz.so.1.2.3
rsyslogd 1965 root  mem    REG                8,1   93416    1097834 /lib64/libgcc_s-4.3.0-20080428.so.1
rsyslogd 1965 root  mem    REG                8,1   53448    1097874 /lib64/librt-2.8.so
rsyslogd 1965 root  mem    REG                8,1   23208    1098015 /lib64/libdl-2.8.so
rsyslogd 1965 root  mem    REG                8,1   11368    4720595 /usr/lib64/rsyslog/imuxsock.so
rsyslogd 1965 root  mem    REG                8,1   23560    4720591 /usr/lib64/rsyslog/imklog.so
rsyslogd 1965 root  mem    REG                8,1   57808    1097853 /lib64/libnss_files-2.8.so
rsyslogd 1965 root  mem    REG                8,1   19504    4720596 /usr/lib64/rsyslog/lmnet.so
rsyslogd 1965 root  mem    REG                8,1    8584    4720598 /usr/lib64/rsyslog/lmtcpclt.so
rsyslogd 1965 root    0u  unix 0xffff880008a31c40            3909712 /dev/log
rsyslogd 1965 root    1w   REG                8,1     435    4014282 /var/log/messages
rsyslogd 1965 root    2w   REG                8,1 7723905    4014355 /var/log/secure
rsyslogd 1965 root    3w   REG                8,1       0    4014356 /var/log/maillog
rsyslogd 1965 root    4w   REG                8,1   58959    4014359 /var/log/cron
rsyslogd 1965 root    5w   REG                8,1       0    4014357 /var/log/spooler
rsyslogd 1965 root    6w   REG                8,1       0    4014358 /var/log/boot.log
rsyslogd 1965 root    7r   REG                0,3       0 4026531849 /proc/kmsg

没有从上面的文件中获得任何线索..

Answer 1

lsof -p `pidof rsyslogd`

Answer 2

lsof非常方便,就像热熔器一样.