BTW, if you are using strace for this, check out the -y option recently added to strace. It will print the filename next to each file descriptor like this:

BTW, if you are using strace for this, check out the -y option recently added to strace. It will print the filename next to each file descriptor like this: read(3</proc/filesystems>, "", 1024) = 0 Another interesting new strace option is -k which does a stack dump after each syscall. this can be useful to find out what part of the application, like some obscure lib, does weird system calls in your app.