Hacker News new | ask | show | jobs
by remram 1345 days ago
It finds the file using /proc/<pid>/fd/<num> and watches its size grow. It doesn't work with pipes, devices, a file being overwritten (not appended to), or anything whose size doesn't grow.
1 comments

It does, even for reading (cat /dev/nvme0n1 > /dev/null). As per changelog:

1.5.2 - 10 February 2014 allow --watchfd to look at block devices

You can see the position in /proc/<pid>/fdinfo/<num>