Hello, I need to know which files under /var a proccess (httpd here) is acessing. It is not logs because I have a different partition for logs. gstat tells me that slice ad0s1h (my /var) is 100% frequently, and in fact with fstat I can see a number of httpd proccesses running accesing that. But fstat only shows me inodes and the mount point. I need to know which files the proccesses are acessing. How? Thank you.
On Jun 06, Eduardo Meyer wrote:> I need to know which files under /var a proccess (httpd here) is > acessing. It is not logs because I have a different partition for > logs. > > gstat tells me that slice ad0s1h (my /var) is 100% frequently, and in > fact with fstat I can see a number of httpd proccesses running > accesing that. But fstat only shows me inodes and the mount point. > > I need to know which files the proccesses are acessing.Linux has a cool program: lsof (list open files). Does FreeBSD have something similar? -Clint
On Tue, Jun 06, 2006 at 05:39:34PM -0300, Eduardo Meyer wrote..> Hello, > > I need to know which files under /var a proccess (httpd here) is > acessing. It is not logs because I have a different partition for > logs. > > gstat tells me that slice ad0s1h (my /var) is 100% frequently, and in > fact with fstat I can see a number of httpd proccesses running > accesing that. But fstat only shows me inodes and the mount point. > > I need to know which files the proccesses are acessing.lsof? $ lsof /var COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME mutt 8018 wb 4r VREG 0,172 163763 47112 /var/mail/wb sh 8024 wb 4r VREG 0,172 163763 47112 /var/mail/wb vi 8025 wb 4r VREG 0,172 163763 47112 /var/mail/wb sh 8031 wb 4r VREG 0,172 163763 47112 /var/mail/wb $ -- Wilko Bulte wilko@FreeBSD.org
On 6/6/06, David Wolfskill <david@catwhisker.org> wrote:> You may find the "lsof" port useful for answering such questions. >I tried it, but it seems that I found some limitations: lsof: no local file space at PID 16543 # ps 16543 PID TT STAT TIME COMMAND 16543 ?? S 0:02.43 /usr/local/sbin/httpd -k start -DSSL Any tuning would do the job?
"Eduardo Meyer" <dudu.meyer@gmail.com> writes:> gstat tells me that slice ad0s1h (my /var) is 100% frequently, and in > fact with fstat I can see a number of httpd proccesses running > accesing that. But fstat only shows me inodes and the mount point. > > I need to know which files the proccesses are acessing. > > How?Map the inodes to files with find(1)?
Hi On Tue, Jun 06, 2006 at 17:39 (-0300), Eduardo Meyer wrote:> Hello, > > I need to know which files under /var a proccess (httpd here) is > acessing. It is not logs because I have a different partition for > logs. > > gstat tells me that slice ad0s1h (my /var) is 100% frequently, and in > fact with fstat I can see a number of httpd proccesses running > accesing that. But fstat only shows me inodes and the mount point. > > I need to know which files the proccesses are acessing. > > How?Try with lsof from ports. /Johan K> > Thank you. > _______________________________________________ > freebsd-stable@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-stable > To unsubscribe, send any mail to "freebsd-stable-unsubscribe@freebsd.org"-- Johan Karlsson mailto:johan@FreeBSD.org
On Tue, 06 Jun 2006 23:14:01 +0200, Clint Olsen <clint@0lsen.net> wrote:> On Jun 06, Eduardo Meyer wrote: >> I need to know which files under /var a proccess (httpd here) is >> acessing. It is not logs because I have a different partition for >> logs. >> >> gstat tells me that slice ad0s1h (my /var) is 100% frequently, and in >> fact with fstat I can see a number of httpd proccesses running >> accesing that. But fstat only shows me inodes and the mount point. >> >> I need to know which files the proccesses are acessing. > > Linux has a cool program: lsof (list open files). Does FreeBSD have > something similar?/usr/ports/sysutils/lsof -- Ronald Klop Amsterdam, The Netherlands
On 6/6/06, pete wright <nomadlogic@gmail.com> wrote:> On 6/6/06, Eduardo Meyer <dudu.meyer@gmail.com> wrote: > > Hello, > >> > I need to know which files under /var a proccess (httpd here) is > > acessing. It is not logs because I have a different partition for > > logs. > > > > gstat tells me that slice ad0s1h (my /var) is 100% frequently, and in > > fact with fstat I can see a number of httpd proccesses running > > accesing that. But fstat only shows me inodes and the mount point. > > > > I need to know which files the proccesses are acessing. > > > > if you can get fstat to help you may want to take a look at lfof,sorry that should be lsof -pete -- ~~o0OO0o~~ Pete Wright www.nycbug.org NYC's *BSD User Group
On Tue, Jun 06, 2006 at 02:14:01PM -0700, Clint Olsen wrote:> ...> > I need to know which files the proccesses are acessing. > > Linux has a cool program: lsof (list open files). Does FreeBSD have > something similar?lsof never has been Linux-specific. Please see sysutils/lsof in your local ports tree. Peace, david -- David H. Wolfskill david@catwhisker.org Doing business with spammers only encourages them. Please boycott spammers. See http://www.catwhisker.org/~david/publickey.gpg for my public key. -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 195 bytes Desc: not available Url : http://lists.freebsd.org/pipermail/freebsd-stable/attachments/20060606/eb505435/attachment.pgp
On Tue, Jun 06, 2006 at 02:14:01PM -0700, Clint Olsen wrote..> On Jun 06, Eduardo Meyer wrote: > > I need to know which files under /var a proccess (httpd here) is > > acessing. It is not logs because I have a different partition for > > logs. > > > > gstat tells me that slice ad0s1h (my /var) is 100% frequently, and in > > fact with fstat I can see a number of httpd proccesses running > > accesing that. But fstat only shows me inodes and the mount point. > > > > I need to know which files the proccesses are acessing. > > Linux has a cool program: lsof (list open files). Does FreeBSD have > something similar?The same: wb@freebie ~: pkg_info | grep lsof lsof-4.76.2 Lists information about open files (similar to fstat(1)) see: /usr/ports/sysutils/lsof -- Wilko Bulte wilko@FreeBSD.org
Matthew D. Fuller
2006-Jun-06 14:37 UTC
How can I know which files a proccess is accessing?
On Tue, Jun 06, 2006 at 02:14:01PM -0700 I heard the voice of Clint Olsen, and lo! it spake thus:> > Linux has a cool program: lsof (list open files). Does FreeBSD have > something similar?fstat. (or lsof in ports, if you wanted) -- Matthew Fuller (MF4839) | fullermd@over-yonder.net Systems/Network Administrator | http://www.over-yonder.net/~fullermd/ On the Internet, nobody can hear you scream.
On 6/6/06, Eduardo Meyer <dudu.meyer@gmail.com> wrote:> Hello, > > I need to know which files under /var a proccess (httpd here) is > acessing. It is not logs because I have a different partition for > logs. > > gstat tells me that slice ad0s1h (my /var) is 100% frequently, and in > fact with fstat I can see a number of httpd proccesses running > accesing that. But fstat only shows me inodes and the mount point. > > I need to know which files the proccesses are acessing. >if you can get fstat to help you may want to take a look at lfof, available in ports: /usr/ports/sysutils/lsof " Lsof (LiSt Open Files) lists information about files that are open by the running processes. An open file may be a regular file, a directory, a block special file, a character special file, an executing text reference, a library, a stream or a network file (Internet socket, NFS file or Unix domain socket). " -pete -- ~~o0OO0o~~ Pete Wright www.nycbug.org NYC's *BSD User Group
Stephen D. Spencer
2006-Jun-06 14:40 UTC
How can I know which files a proccess is accessing?
On 6/6/06, Eduardo Meyer <dudu.meyer@gmail.com> wrote:> > Hello, > > I need to know which files under /var a proccess (httpd here) is > acessing. It is not logs because I have a different partition for > logs. > > [...]check out ./ports/sysutils/lsof. An excellent little util that has become a standard on all of my *NIXish installs. It'll tell you all you ever wanted to know (and more) about which pieces of your OS are touching what. -- Stephen Spencer Lawrence, KS "If God dropped acid, would he see people?"
On Tuesday 06 June 2006 05:14 pm, Clint Olsen wrote:> On Jun 06, Eduardo Meyer wrote: > > I need to know which files under /var a proccess (httpd here) is > > acessing. It is not logs because I have a different partition for > > logs. > > > > gstat tells me that slice ad0s1h (my /var) is 100% frequently, > > and in fact with fstat I can see a number of httpd proccesses > > running accesing that. But fstat only shows me inodes and the > > mount point. > > > > I need to know which files the proccesses are acessing. > > Linux has a cool program: lsof (list open files). Does FreeBSD > have something similar?http://www.freebsd.org/cgi/cvsweb.cgi/ports/sysutils/lsof/ Jung-uk Kim
On Tue, 6 Jun 2006, Clint Olsen wrote:> > Linux has a cool program: lsof (list open files). Does FreeBSD have > something similar?% cd /usr/ports % make search name=lsof Port: lsof-4.76.1.1 Path: /usr/ports/sysutils/lsof Info: Lists information about open files (similar to fstat(1)) Maint: obrien@FreeBSD.org B-deps: R-deps: WWW: http://people.freebsd.org/~abe/ -- Brian Tao, Luxography http://www.luxography.ca/ (main) http://blog.luxography.ca/ (blog) "The art of light"
Eduardo Meyer wrote:> Hello, > > I need to know which files under /var a proccess (httpd here) is > acessing. It is not logs because I have a different partition for > logs.Is everyone forgetting the command "fstat" that comes with freebsd? :)
Eduardo Meyer wrote:> Hello, > > I need to know which files under /var a proccess (httpd here) is > acessing. It is not logs because I have a different partition for > logs. > > gstat tells me that slice ad0s1h (my /var) is 100% frequently, and in > fact with fstat I can see a number of httpd proccesses running > accesing that. But fstat only shows me inodes and the mount point. > > I need to know which files the proccesses are acessing.find(1) can match inodes. A quick example: > fstat | grep 'httpd.*/var ' | awk '{print $6}' | xargs -n 1 sudo find -x /var -inum | sort -u /var/log/httpd-error.log /var/run/accept.lock.# /var/tmp/apr8530d5 /var/tmp/aprF2Zs0e -- Darren Pilgrim
On Tue, 6 Jun 2006, Eduardo Meyer wrote:> I need to know which files under /var a proccess (httpd here) is acessing. > It is not logs because I have a different partition for logs. > > gstat tells me that slice ad0s1h (my /var) is 100% frequently, and in fact > with fstat I can see a number of httpd proccesses running accesing that. But > fstat only shows me inodes and the mount point. > > I need to know which files the proccesses are acessing.A lot of people have answered and told you about lsof, which is a great tool, and can give you a momentary snapshot of the files a process has open. You might also be interested in getting a log of accesses, which you can do using ktrace(1). This tracks system calls and you can see what paths are being accessed at time of open. As of 7.x (and hopefully 6.2 once the MFC happens) you'll also be able to use audit(4) to track access of files by processes. Robert N M Watson
It is worth mentioning that lsof is also extremely useful for finding inodes that have a link count of 0, i.e. files that have been deleted but are still open by a process. "lsof +L1" will list them with their inode numbers and the PIDs of the processes that keep them open. Best regards Oliver -- Oliver Fromme, secnetix GmbH & Co. KG, Marktplatz 29, 85567 Grafing Dienstleistungen mit Schwerpunkt FreeBSD: http://www.secnetix.de/bsd Any opinions expressed in this message may be personal to the author and may not necessarily reflect the opinions of secnetix in any way. "Clear perl code is better than unclear awk code; but NOTHING comes close to unclear perl code" (taken from comp.lang.awk FAQ)
On 06/06/06 15:39, Eduardo Meyer wrote:> Hello, > > I need to know which files under /var a proccess (httpd here) is > acessing. It is not logs because I have a different partition for > logs. > > gstat tells me that slice ad0s1h (my /var) is 100% frequently, and in > fact with fstat I can see a number of httpd proccesses running > accesing that. But fstat only shows me inodes and the mount point. > > I need to know which files the proccesses are acessing. > > How?Just in case you didn't get enough responses.... Here's a *great* article: http://www.onlamp.com/pub/a/bsd/2002/09/26/Big_Scary_Daemons.html?page=1> > Thank you. > _______________________________________________ > freebsd-stable@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-stable > To unsubscribe, send any mail to "freebsd-stable-unsubscribe@freebsd.org" >-- Regards, Eric