On Linux, this can be done using BPF (Berkley Packet Filter). In fact there is a tool in BCC[0] called filetop, which lists reads/writes by process and file[1].

On Linux, this can be done using BPF (Berkley Packet Filter). In fact there is a tool in BCC[0] called filetop, which lists reads/writes by process and file[1]. 0. https://github.com/iovisor/bcc https://github.com/iovisor/bcc 1. https://github.com/iovisor/bcc/blob/master/tools/filetop.py https://github.com/iovisor/bcc/blob/master/tools/filetop.py