How can I know which files a proccess is accessing?

[Matthias Andree]

"Eduardo Meyer" <dudu.meyer at gmail.com> writes:

> On 6/6/06, David Wolfskill <david at catwhisker.org> wrote:
>> You may find the "lsof" port useful for answering such questions.
>>
>
> I tried it, but it seems that I found some limitations:
>
> lsof: no local file space at PID 16543
>
> # ps 16543
>  PID  TT  STAT      TIME COMMAND
> 16543  ??  S      0:02.43 /usr/local/sbin/httpd -k start -DSSL
>
> Any tuning would do the job?

Are you running with tightened up security that might prevent fstat from
accessing /dev/kmem?  I don't know fstat failures from experience or
what causes it to just show inode numbers - perhaps delete files that
are still open.

I'm unsure about the reason for lsof's complaint; if you installed a
package, try rebuilding the port.

Something different, if fstat and lsof continue to fail: you may try
attaching a syscall tracer such as truss, ktrace or strace (the latter
from ports) to the process and see if it leaks file descriptors. This
may fail due to permissions however.

-- 
Matthias Andree