How can I know which files a proccess is accessing?

Michael Hall mhall at riverside.org
Wed Jun 7 22:18:30 UTC 2006


On Wed, Jun 07, 2006 at 08:20:03AM -0700, pete wright wrote:

> On 6/6/06, Darren Pilgrim <darren.pilgrim at bitfreak.org> wrote:
> >Eduardo Meyer wrote:
> >> Hello,
> >>
> >> I need to know which files under /var a proccess (httpd here) is
> >> acessing. It is not logs because I have a different partition for
> >> logs.
> >>
> >> gstat tells me that slice ad0s1h (my /var) is 100% frequently, and in
> >> fact with fstat I can see a number of httpd proccesses running
> >> accesing that. But fstat only shows me inodes and the mount point.
> >>
> >> I need to know which files the proccesses are acessing.
> >
> >find(1) can match inodes.  A quick example:
> >
> > > fstat | grep 'httpd.*/var ' | awk '{print $6}' | xargs -n 1 sudo find
> >-x /var -inum | sort -u
> >/var/log/httpd-error.log
> >/var/run/accept.lock.#
> >/var/tmp/apr8530d5
> >/var/tmp/aprF2Zs0e
> >
> 
> Thanks for the oneliner Darren, that's going in my scripts dir right now ;)

Yes, it does look handy, another new usage for 'find'.

Typically a 'grep ... | awk ...' can be combined, resulting in a small
improvement:

fstat | awk '/httpd.*\/var/ { print $6 }' | xargs ...

--
Why doesn't "Buick" rhyme with "quick"?

Mike Hall
San Juan Island, WA

System Admin - Rock Island Communications           <mikeh at rockisland.com>
System Admin - riverside.org, ssdd.org              <mhall at riverside.org>


More information about the freebsd-stable mailing list