shell - How to get files modified by certain process in Linux -

need find out files getting modified process.

tried lsof -p processid gives files opened process. want command or set of commands files opened , modified process.

if process not running, can use strace print system calls

strace -o logfile  <program> 

after this, write script open() , write() system calls, , able print lists of files written too.

if process running, have use combination of several things

• lsof -p or /proc/<processid>/fd/*
• last modified time stamp of files found in above
• output of strace -p <processid> write() , open()

hope helps