From owner-freebsd-stable@FreeBSD.ORG Wed Jun 7 17:44:58 2006 Return-Path: X-Original-To: stable@freebsd.org Delivered-To: freebsd-stable@FreeBSD.ORG Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 2FE9B16DF54 for ; Wed, 7 Jun 2006 15:20:05 +0000 (UTC) (envelope-from nomadlogic@gmail.com) Received: from wx-out-0102.google.com (wx-out-0102.google.com [66.249.82.195]) by mx1.FreeBSD.org (Postfix) with ESMTP id B50C143D49 for ; Wed, 7 Jun 2006 15:20:04 +0000 (GMT) (envelope-from nomadlogic@gmail.com) Received: by wx-out-0102.google.com with SMTP id i31so145634wxd for ; Wed, 07 Jun 2006 08:20:04 -0700 (PDT) DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com; h=received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=PPdwDBPmoJCgD6H4FWWhbW0EQBdm3xY0vSl4+vWL9cCsBxSTWCFEFk1PTvpybVRnt5qd+1ioHSo+OFN2hby/b9ZCadInhl0G5wPyHMaamnexb2VDH+DjGrJ3BbEIZeG1UUL6rNWOBjb6xjQFe0MGX/BlGPz3B5cR7I/V53SpyGo= Received: by 10.70.33.8 with SMTP id g8mr838928wxg; Wed, 07 Jun 2006 08:20:03 -0700 (PDT) Received: by 10.70.83.15 with HTTP; Wed, 7 Jun 2006 08:20:03 -0700 (PDT) Message-ID: <57d710000606070820j6291f74el6b6880e681899904@mail.gmail.com> Date: Wed, 7 Jun 2006 08:20:03 -0700 From: "pete wright" To: "Darren Pilgrim" In-Reply-To: <4486574F.9040108@bitfreak.org> MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Content-Disposition: inline References: <4486574F.9040108@bitfreak.org> Cc: stable@freebsd.org, Eduardo Meyer Subject: Re: How can I know which files a proccess is accessing? X-BeenThere: freebsd-stable@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Production branch of FreeBSD source code List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Jun 2006 17:44:59 -0000 On 6/6/06, Darren Pilgrim wrote: > Eduardo Meyer wrote: > > Hello, > > > > I need to know which files under /var a proccess (httpd here) is > > acessing. It is not logs because I have a different partition for > > logs. > > > > gstat tells me that slice ad0s1h (my /var) is 100% frequently, and in > > fact with fstat I can see a number of httpd proccesses running > > accesing that. But fstat only shows me inodes and the mount point. > > > > I need to know which files the proccesses are acessing. > > find(1) can match inodes. A quick example: > > > fstat | grep 'httpd.*/var ' | awk '{print $6}' | xargs -n 1 sudo find > -x /var -inum | sort -u > /var/log/httpd-error.log > /var/run/accept.lock.# > /var/tmp/apr8530d5 > /var/tmp/aprF2Zs0e > Thanks for the oneliner Darren, that's going in my scripts dir right now ;) -pete -- ~~o0OO0o~~ Pete Wright www.nycbug.org NYC's *BSD User Group