How can I know which files a proccess is accessing?

[Darren Pilgrim]

Eduardo Meyer wrote:
> Hello,
> 
> I need to know which files under /var a proccess (httpd here) is
> acessing. It is not logs because I have a different partition for
> logs.
> 
> gstat tells me that slice ad0s1h (my /var) is 100% frequently, and in
> fact with fstat I can see a number of httpd proccesses running
> accesing that. But fstat only shows me inodes and the mount point.
> 
> I need to know which files the proccesses are acessing.

find(1) can match inodes.  A quick example:

 > fstat | grep 'httpd.*/var ' | awk '{print $6}' | xargs -n 1 sudo find 
-x /var -inum | sort -u
/var/log/httpd-error.log
/var/run/accept.lock.#
/var/tmp/apr8530d5
/var/tmp/aprF2Zs0e

-- 
Darren Pilgrim