From owner-freebsd-stable@FreeBSD.ORG Wed Jun 7 22:18:30 2006 Return-Path: X-Original-To: freebsd-stable@freebsd.org Delivered-To: freebsd-stable@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id D3AC516B2D3 for ; Wed, 7 Jun 2006 19:57:35 +0000 (UTC) (envelope-from mhall@nowthen.riverside.org) Received: from ukiah.riverside.org (a.mx.riverside.org [64.119.4.10]) by mx1.FreeBSD.org (Postfix) with ESMTP id 3F2F243D46 for ; Wed, 7 Jun 2006 19:57:35 +0000 (GMT) (envelope-from mhall@nowthen.riverside.org) Received: from localhost (localhost.riverside.org [127.0.0.1]) by localhost.riverside.org (Postfix) with ESMTP id 7161A98A for ; Wed, 7 Jun 2006 12:57:34 -0700 (PDT) (envelope-from mhall@nowthen.riverside.org) X-Virus-Scanned: amavisd-new at riverside.org Received: from ukiah.riverside.org ([127.0.0.1]) by localhost (ukiah.riverside.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DkOfS0vtlDny for ; Wed, 7 Jun 2006 12:57:26 -0700 (PDT) Received: from nowthen.riverside.org (nowthen.riverside.org [64.119.4.11]) by ukiah.riverside.org (Postfix) with ESMTP id 8E4CF8F3 for ; Wed, 7 Jun 2006 12:57:26 -0700 (PDT) (envelope-from mhall@nowthen.riverside.org) Received: from nowthen.riverside.org (localhost [127.0.0.1]) by nowthen.riverside.org (Postfix) with ESMTP id 6CE894FCE2 for ; Wed, 7 Jun 2006 12:57:26 -0700 (PDT) Received: (from mhall@localhost) by nowthen.riverside.org (8.13.6/8.13.3/Submit) id k57JvQXY026118 for freebsd-stable@freebsd.org; Wed, 7 Jun 2006 12:57:26 -0700 Date: Wed, 7 Jun 2006 12:57:26 -0700 From: Michael Hall To: freebsd-stable@freebsd.org Message-ID: <20060607195726.GD25975@riverside.org> Mail-Followup-To: freebsd-stable@freebsd.org References: <4486574F.9040108@bitfreak.org> <57d710000606070820j6291f74el6b6880e681899904@mail.gmail.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <57d710000606070820j6291f74el6b6880e681899904@mail.gmail.com> User-Agent: Mutt/1.4.2.1i Subject: Re: How can I know which files a proccess is accessing? X-BeenThere: freebsd-stable@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Production branch of FreeBSD source code List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Jun 2006 22:18:30 -0000 On Wed, Jun 07, 2006 at 08:20:03AM -0700, pete wright wrote: > On 6/6/06, Darren Pilgrim wrote: > >Eduardo Meyer wrote: > >> Hello, > >> > >> I need to know which files under /var a proccess (httpd here) is > >> acessing. It is not logs because I have a different partition for > >> logs. > >> > >> gstat tells me that slice ad0s1h (my /var) is 100% frequently, and in > >> fact with fstat I can see a number of httpd proccesses running > >> accesing that. But fstat only shows me inodes and the mount point. > >> > >> I need to know which files the proccesses are acessing. > > > >find(1) can match inodes. A quick example: > > > > > fstat | grep 'httpd.*/var ' | awk '{print $6}' | xargs -n 1 sudo find > >-x /var -inum | sort -u > >/var/log/httpd-error.log > >/var/run/accept.lock.# > >/var/tmp/apr8530d5 > >/var/tmp/aprF2Zs0e > > > > Thanks for the oneliner Darren, that's going in my scripts dir right now ;) Yes, it does look handy, another new usage for 'find'. Typically a 'grep ... | awk ...' can be combined, resulting in a small improvement: fstat | awk '/httpd.*\/var/ { print $6 }' | xargs ... -- Why doesn't "Buick" rhyme with "quick"? Mike Hall San Juan Island, WA System Admin - Rock Island Communications System Admin - riverside.org, ssdd.org