How to list open files in read-write and write-only on a BTRFS filesystem?

Question

I'm writing a bash backup script, which creates BTRFS subvolume snapshots on a mounted volume (i.e. /mnt/btrfs/subvolume). As usual I would use "lsof /mnt/btrfs/subvolume" and pipe its output to something like "awk 'NR==1 || $4~/[0-9][uw]/'", so I can see if there are any changing files.

COMMAND   PID USER   FD   TYPE DEVICE SIZE/OFF    NODE NAME
sh       5019 root    1w   REG   8,35  2088960      12 /mnt/ext4/currently_generated_archive.tar.xz

This will not work on BTRFS the same way and does not return open files for writing. My best guess is that BTRFS subvolumes use "Copy on Write" and thus kernel/lsof is somehow fooled and not showing these changes. Does anyone know, how I can check if any files are being changed/written under mounted BTRFS subvolume?

Regards

score 0 · Accepted Answer · answered Mar 26 '20 at 14:13

I worked this around by omitting all parameters to lsof and directly grepping for the BTRFS mountpoint and finally applying the write filter, so it becomes sort of:

lsof | grep /some/BTRFS_mount_point | awk '$4~/[0-9][uw]/'

I'm using Debian 10 for the test and for some reason lsof /some/BTRFS_mount_point will never return writes, which works fine with similar mounted ext4 volume.

How to list open files in read-write and write-only on a BTRFS filesystem?

1 Answers1