Useful trick when lsof is not present

ps -o pid,ppid,rss,args -p "$(fuser / 2>/dev/null)"
processes with open files for root fs