Date: Wed, 7 Jun 2006 12:57:26 -0700 From: Michael Hall <mhall@riverside.org> To: freebsd-stable@freebsd.org Subject: Re: How can I know which files a proccess is accessing? Message-ID: <20060607195726.GD25975@riverside.org> In-Reply-To: <57d710000606070820j6291f74el6b6880e681899904@mail.gmail.com> References: <d3ea75b30606061339u55efbecemab0d3d0eb9adb636@mail.gmail.com> <4486574F.9040108@bitfreak.org> <57d710000606070820j6291f74el6b6880e681899904@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Wed, Jun 07, 2006 at 08:20:03AM -0700, pete wright wrote:
> On 6/6/06, Darren Pilgrim <darren.pilgrim@bitfreak.org> wrote:
> >Eduardo Meyer wrote:
> >> Hello,
> >>
> >> I need to know which files under /var a proccess (httpd here) is
> >> acessing. It is not logs because I have a different partition for
> >> logs.
> >>
> >> gstat tells me that slice ad0s1h (my /var) is 100% frequently, and in
> >> fact with fstat I can see a number of httpd proccesses running
> >> accesing that. But fstat only shows me inodes and the mount point.
> >>
> >> I need to know which files the proccesses are acessing.
> >
> >find(1) can match inodes. A quick example:
> >
> > > fstat | grep 'httpd.*/var ' | awk '{print $6}' | xargs -n 1 sudo find
> >-x /var -inum | sort -u
> >/var/log/httpd-error.log
> >/var/run/accept.lock.#
> >/var/tmp/apr8530d5
> >/var/tmp/aprF2Zs0e
> >
>
> Thanks for the oneliner Darren, that's going in my scripts dir right now ;)
Yes, it does look handy, another new usage for 'find'.
Typically a 'grep ... | awk ...' can be combined, resulting in a small
improvement:
fstat | awk '/httpd.*\/var/ { print $6 }' | xargs ...
--
Why doesn't "Buick" rhyme with "quick"?
Mike Hall
San Juan Island, WA
System Admin - Rock Island Communications <mikeh@rockisland.com>
System Admin - riverside.org, ssdd.org <mhall@riverside.org>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20060607195726.GD25975>