See which file is preventing you from mount read-only

In embedded systems, you can make your entire root file system read only (therefore preventing flash corruption) by doing:

mount -o remount,ro /

But sometimes this fails, because some files are being open as "writable". We need to find a way to identify these processes. lsof comes to rescue.
 
lsof +D / | awk $4~/w$/{print}

This commands list all open files recursively then uses an one-line awk script to find the lines that have files open for write. 

lsof is a really good friend. :-)