Skip site navigation (1)Skip section navigation (2)
Date:      Wed, 7 Jun 2006 22:19:58 -0400
From:      "Zaphod Beeblebrox" <zbeeble@gmail.com>
To:        freebsd-stable@freebsd.org
Subject:   Re: How can I know which files a proccess is accessing?
Message-ID:  <5f67a8c40606071919v4b253808ge5993a1b640d1942@mail.gmail.com>
In-Reply-To: <20060607195726.GD25975@riverside.org>
References:  <d3ea75b30606061339u55efbecemab0d3d0eb9adb636@mail.gmail.com> <4486574F.9040108@bitfreak.org> <57d710000606070820j6291f74el6b6880e681899904@mail.gmail.com> <20060607195726.GD25975@riverside.org>

next in thread | previous in thread | raw e-mail | index | archive | help
Note that problems with lsof are generally fixed by recompiling it.  It
doesn't take well to upgrades of the OS underneath it.

On 6/7/06, Michael Hall <mhall@riverside.org> wrote:
>
> On Wed, Jun 07, 2006 at 08:20:03AM -0700, pete wright wrote:
>
> > On 6/6/06, Darren Pilgrim <darren.pilgrim@bitfreak.org> wrote:
> > >Eduardo Meyer wrote:
> > >> Hello,
> > >>
> > >> I need to know which files under /var a proccess (httpd here) is
> > >> acessing. It is not logs because I have a different partition for
> > >> logs.
> > >>
> > >> gstat tells me that slice ad0s1h (my /var) is 100% frequently, and in
> > >> fact with fstat I can see a number of httpd proccesses running
> > >> accesing that. But fstat only shows me inodes and the mount point.
> > >>
> > >> I need to know which files the proccesses are acessing.
> > >
> > >find(1) can match inodes.  A quick example:
> > >
> > > > fstat | grep 'httpd.*/var ' | awk '{print $6}' | xargs -n 1 sudo
> find
> > >-x /var -inum | sort -u
> > >/var/log/httpd-error.log
> > >/var/run/accept.lock.#
> > >/var/tmp/apr8530d5
> > >/var/tmp/aprF2Zs0e
> > >
> >
> > Thanks for the oneliner Darren, that's going in my scripts dir right now
> ;)
>
> Yes, it does look handy, another new usage for 'find'.
>
> Typically a 'grep ... | awk ...' can be combined, resulting in a small
> improvement:
>
> fstat | awk '/httpd.*\/var/ { print $6 }' | xargs ...
>
> --
> Why doesn't "Buick" rhyme with "quick"?
>
> Mike Hall
> San Juan Island, WA
>
> System Admin - Rock Island Communications           <mikeh@rockisland.com>
> System Admin - riverside.org, ssdd.org              <mhall@riverside.org>
> _______________________________________________
> freebsd-stable@freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-stable
> To unsubscribe, send any mail to "freebsd-stable-unsubscribe@freebsd.org"
>



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?5f67a8c40606071919v4b253808ge5993a1b640d1942>