Like ir. Jan Gerrit said - you should probably call Red Hat support.

that being said - this might help you determine what specific processes are writing to the disk, and may or may not help you...

If you'd like to find the specific processes are involved that are writing to disk for the user, you might be able to try the following...
*(Perhaps you can do this when (as you mention) the ps process is not being blocked)

First - find the name of the user with the process

ps -ef >output.txt

Sort the results - and hopefully the user is not root

sort output.txt > sorted_output.txt

Examine the file and hopefully you can find the name of the user for the process involved,
if so (let's call the user "jack" for the purpose of the script below).

[root@yoursystem ~]# [root@yoursystem ~]# echo "this will only work if the process is writing to a disk"
[root@yoursystem ~]# lsof -l -n -P | grep jack | awk '{print $2}' | sort | uniq | perl -ne 'print;chomp;system("ps -ef | grep $_")' | grep jack | awk '{print $8}'| sort | uniq

Good luck.

Hello PixelDrift.NET,
I examined both commands against a qemu process running on one of my systems and discovered they both produced nearly identical results for checking a qemu process,

While your comment that the "-l" inhibits the conversion of user ID numbers to login names, that point is irrelevant in this case and use of the command because it produced the final process of "/usr/libexec/qemu-kvm".

The difference between the two shows "qemu 4179 1 3 20:25 ? 00:02:02", and all the associated arguments to the resultant process from examining the nodes of column 8 of the lsof command.

• Your command is shorter, I like the brevity of it.

Your lsof command you posted with xargs is nice, I did not know xargs could be used with lsof.

• And this produced the nearly idential report.
• Here are the two commands, (in this case, mine is missing the final "| awk '{print $8}'| sort | uniq"

[root@test1 ~]# lsof -nPFp -u qemu | cut -c2- | xargs ps -o cmd= -p1 | grep -v ^.*/init$
/usr/libexec/qemu-kvm -name virt1 -S -M rhel7.0.0 -enable-kvm -m 4096 -realtime mlock=off -smp 
2,sockets=2,cores=1,threads=1 -uuid 03552cab-a4b3-4d9e-8f76-2cf7e662e45c -nodefconfig -nodefaults 
-chardev socket,id=charmonitor,path=/var/lib/libvirt/qemu/virt1.monitor,server,nowait -mon 
chardev=charmonitor,id=monitor,mode=control -rtc base=utc -no-shutdown -device piix3-
usb-uhci,id=usb,bus=pci.0,addr=0x1.0x2 -drive file=/vm/virt1.img,if=none,id=drive-virtio-
lv_test,format=raw,cache=none -device virtio-blk-pci,scsi=off,bus=pci.0,addr=0x5,drive=drive-
virtio-lv_test,id=virtio-lv_test,bootindex=1 -drive file=/coffee/Downloads
/some.iso,if=none,media=cdrom,id=drive-ide0-1-0,readonly=on,format=raw -device 
ide-drive,bus=ide.1,unit=0,drive=drive-ide0-1-0,id=ide0-1-0,bootindex=2 -netdev 
tap,fd=23,id=hostnet0,vhost=on,vhostfd=24 -device virtio-
net-pci,netdev=hostnet0,id=net0,mac=00:00:00:00:00:00,bus=pci.0,addr=0x3 -chardev 
pty,id=charserial0 -device isa-serial,chardev=charserial0,id=serial0 -device usb-tablet,id=input0
 -vnc 127.0.0.1:0 -vga cirrus -device intel-hda,id=sound0,bus=pci.0,addr=0x4 -device 
hda-duplex,id=sound0-codec0,bus=sound0.0,cad=0 -device virtio-balloon-
pci,id=balloon0,bus=pci.0,addr=0x6


lsof -l -n -P | grep qemu | awk '{print $2}' | sort | uniq | perl -ne 'print;chomp;system("ps -ef | grep $_")' | grep qemu
qemu      4179     1  3 20:25 ?        00:02:02  /usr/libexec/qemu-kvm -name virt1 -S -M 
rhel7.0.0 -enable-kvm -m 4096 -realtime mlock=off -smp 2,sockets=2,cores=1,threads=1 -uuid 
03552cab-a4b3-4d9e-8f76-2cf7e662e45c -nodefconfig -nodefaults -chardev 
socket,id=charmonitor,path=/var/lib/libvirt/qemu/virt1.monitor,server,nowait -mon 
chardev=charmonitor,id=monitor,mode=control -rtc base=utc -no-shutdown -device piix3-
usb-uhci,id=usb,bus=pci.0,addr=0x1.0x2 -drive file=/vm/virt1.img,if=none,id=drive-virtio-
lv_test,format=raw,cache=none -device virtio-blk-pci,scsi=off,bus=pci.0,addr=0x5,drive=drive-
virtio-lv_test,id=virtio-lv_test,bootindex=1 -drive file=/coffee/Downloads
/some.iso,if=none,media=cdrom,id=drive-ide0-1-0,readonly=on,format=raw -device 
ide-drive,bus=ide.1,unit=0,drive=drive-ide0-1-0,id=ide0-1-0,bootindex=2 -netdev 
tap,fd=23,id=hostnet0,vhost=on,vhostfd=24 -device virtio-
net-pci,netdev=hostnet0,id=net0,mac=00:00:00:00:00:00,bus=pci.0,addr=0x3 -chardev 
pty,id=charserial0 -device isa-serial,chardev=charserial0,id=serial0 -device usb-tablet,id=input0 
-vnc 127.0.0.1:0 -vga cirrus -device intel-hda,id=sound0,bus=pci.0,addr=0x4 -device 
hda-duplex,id=sound0-codec0,bus=sound0.0,cad=0 -device virtio-balloon-
pci,id=balloon0,bus=pci.0,addr=0x6

Now if I run theese with a final bit of awk to show the process only within of the output to the space:

lsof -l -n -P | grep qemu | awk '{print $2}' | sort | uniq | perl -ne 'print;chomp;system("ps -ef | grep $_")' | grep qemu | awk '{print $8}'| sort | uniq
/usr/libexec/qemu-kvm

lsof -nPFp -u qemu | cut -c2- | xargs ps -o cmd= -p1 | grep -v ^.*/init$ | grep qemu | awk '{print $1}'
/usr/libexec/qemu-kvm

So the "-l" inclusion is not an issue and the two scripts do produce the same output when taylored a bit.

I appreciate you posting the lsof command you presented with the use of cut and xargs. It is nice to see a different way to produce the same output. I like to compare methods and see how others achieve results from queries since there are so many ways to do things within Linux.

I'll examine/compare your commands you post in the discussions here in the future, it is good to learn things from others and to deduce different methods of commands.

Thanks
Remmele