no special ext3 hooks needed; just check lsof , or rather, /proc/<pid>/fd/* and /proc/<pid>/fdinfo/* (where lsof gets the information, AFAICT). There you can check if the file is open, if it is writable, and the cursor position.
This is not the whole picture; but during the processing process, stdlib is no longer executed during the writing process, since most write operations are buffered and the kernel sees only large chunks of data, so any monitor with ext3 support will also not get this.
source share