On Sun, Sep 21, 2008 at 8:55 AM, Jianhua Yang <[EMAIL PROTECTED]> wrote:
> Hi Mike,
>
> thanks a lot for your kind reply !!!
>
>> I don't use dtrace for this - I use find. For example:
>>
>> # find /proc/*/fd -type f -links 0 \! -size 0 -ls | sort -n +1
> this will list the inode number, but does not tell the file name
If the file has been removed, nothing will tell you the file name - it
no longer has a name.
> use ps to list and check the pid cost a lot of time.
The "find" command that I listed will take a lot more time than ps.
On an Ultra 2 (great machine in 1996) running a fairly default
installation of snv_90, find takes about 0.10 sec of CPU time. In
comparison, the following takes on average about 5.9 seconds (59 times
the CPU time of find):
dtrace -n 'BEGIN { printf("Hello World!\n"); exit(0); }'
If you have a system with tens of thousands of processes or with some
processes with many thousands of open files and those processes are
sensitive to a millisecond or so of a pause, then you have something
to worry about.
Even the following is a lot more efficient than a minimal dtrace
script that doesn't even do what you need:
# time ksh -c 'find /proc/*/fd -type f -links 0 \! -size 0 \
| while IFS=/ read j1 j2 pid j3 fd ; do \
echo "PID: $pid FD $fd"; \
echo "Command: $(ps -o args= -p $pid)" ; \
ls -l /proc/$pid/fd/$fd ; \
done'
PID: 9 FD: 4
Command: /lib/svc/bin/svc.configd
-rw------- 0 root root 2048 Sep 20 16:29 /proc/9/fd/4
PID: 9 FD: 6
Command: /lib/svc/bin/svc.configd
-rw------- 0 root root 2048 Sep 20 16:29 /proc/9/fd/6
real 0m0.210s
user 0m0.042s
sys 0m0.168s
> so I'd like to write one line dtrace script to get all the pids who still
> reference
> those deleted files
With dtrace, you will need to wait until a process does something
(e.g. writes) to the file descriptor. If the process that has the
large, deleted, open file never does anything with it then dtrace will
never see it. Perhaps it is an administrator doing "more biglog" then
realized it was time to leave for a vacation and didn't quit more or
log out.
--
Mike Gerdts
http://mgerdts.blogspot.com/
_______________________________________________
dtrace-discuss mailing list
[email protected]
