I've been searching for a solution on Linux to find out what thread first aquired a fd but no luck for now.
/proc/pid/task/
shows the fd to be available to each thread, which makes sense since descriptors are available troughout the whole process space.
lsof
is of course not of much help either for this usecase.
The program is very complex, and strace or gdb won't help either, there are tons of closed source libraries used. File path is known but does not help since I don't have access to the code in the libaries. I suspect the fd leak is due to some race condition that occurrs very very rarely and I need to trace the thread that did opened the file.
One solution that would be easy to implement would be for me to add a log in the kernel file open handler or in the c library, but for good reasons I'm not able to alter nor the kernel neither the standard library.
Some suggestions?
If you have kernel symbols available use SystemTap:
sudo stap -e 'probe syscall.open.return { \
printf("tid=%d, fd=%d\n", tid(), $return) }'