From owner-freebsd-stable@FreeBSD.ORG Wed Jun 7 19:37:56 2006 Return-Path: X-Original-To: stable@freebsd.org Delivered-To: freebsd-stable@FreeBSD.ORG Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 81C8816F284 for ; Wed, 7 Jun 2006 17:44:08 +0000 (UTC) (envelope-from rwatson@FreeBSD.org) Received: from cyrus.watson.org (cyrus.watson.org [209.31.154.42]) by mx1.FreeBSD.org (Postfix) with ESMTP id E050143D4C for ; Wed, 7 Jun 2006 17:44:07 +0000 (GMT) (envelope-from rwatson@FreeBSD.org) Received: from fledge.watson.org (fledge.watson.org [209.31.154.41]) by cyrus.watson.org (Postfix) with ESMTP id DF9F146BBD; Wed, 7 Jun 2006 13:44:05 -0400 (EDT) Date: Wed, 7 Jun 2006 18:44:05 +0100 (BST) From: Robert Watson X-X-Sender: robert@fledge.watson.org To: Eduardo Meyer In-Reply-To: Message-ID: <20060607184236.P53690@fledge.watson.org> References: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed Cc: stable@freebsd.org Subject: Re: How can I know which files a proccess is accessing? X-BeenThere: freebsd-stable@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Production branch of FreeBSD source code List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Jun 2006 19:37:57 -0000 On Tue, 6 Jun 2006, Eduardo Meyer wrote: > I need to know which files under /var a proccess (httpd here) is acessing. > It is not logs because I have a different partition for logs. > > gstat tells me that slice ad0s1h (my /var) is 100% frequently, and in fact > with fstat I can see a number of httpd proccesses running accesing that. But > fstat only shows me inodes and the mount point. > > I need to know which files the proccesses are acessing. A lot of people have answered and told you about lsof, which is a great tool, and can give you a momentary snapshot of the files a process has open. You might also be interested in getting a log of accesses, which you can do using ktrace(1). This tracks system calls and you can see what paths are being accessed at time of open. As of 7.x (and hopefully 6.2 once the MFC happens) you'll also be able to use audit(4) to track access of files by processes. Robert N M Watson