Eric,
my original question:
file system was filled up and files were deleled by someone while there still
had processes referencing those deleted files,
the disk space was not released, the result of du was different from output
of df.
now how to use dtrace to find the pids that were still referencing those
deleted files ?
# dtrace -n 'io:::start { @files[pid, execname, args[2]->fi_pathname] =
sum(args[0]->b_bcount);} tick-5sec {exit(0);}'
this will find out the processes that have write IO, such as tape backup.
if cmd of more or tail still were referencing the deleted file, the above
dtrace could not file the process of more or tail,
if there were no read IO from cmd of more or tail.
so do I still IO provider to trace the process ? how ?
[EMAIL PROTECTED] wrote on 09/21/2008 10:39:08 AM:
> Jianhua Yang wrote:
> > Hi Mike,
> >
> > thanks a lot for your kind reply !!!
> >
> >> I don't use dtrace for this - I use find. For example:
> >>
> >> # find /proc/*/fd -type f -links 0 \! -size 0 -ls | sort -n +1
> > this will list the inode number, but does not tell the file
> name, use ps
> > to list
> > and check the pid cost a lot of time.
> > [...]
>
> Maybe I'm missing something, but what do you mean by the
> "name" of a file that has been deleted? Remember, a file's
> name is just some text in a directory entry, and once the
> directory entry is gone ...
# find /proc/*/fd -type f -links 0 \! -size 0 -ls | sort -n +1
20 5245448 -r-------T 0 root root 5368709120 Sep 20 20:59
/proc/1425/fd/0
the cmd shows the inode # of 0 only, I want to know the filename of
this inode.
>
> --
> [EMAIL PROTECTED]
---
This e-mail may contain confidential and/or privileged information. If you
are not the intended recipient (or have received this e-mail in error)
please notify the sender immediately and destroy this e-mail. Any
unauthorized copying, disclosure or distribution of the material in this
e-mail is strictly forbidden._______________________________________________
dtrace-discuss mailing list
[email protected]
