# lsof -f -- <path of file name>
linuxmach# lsof -f -- /var/log/secure
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
syslogd 3065 root 3w REG 253,0 40558 169083 /var/log/secure
The file '/var/log/secure' is being accessed by "syslogd" dameon with the PID 3065 and it is being written now.