Of course, this doesn't identify tasks that run, write to /usr, then
terminate, unless you're lucky enough to run the command during the
(probably short) time period the file is open.
One way to get some clues about tasks that might be doing that is by
identifying which files have been modified:
find /usr -mtime -1
run once each day at the same time will list all the files that have been
modified in the last 24 hours.
Mark Post
-----Original Message-----
From: Samuel S Chessman [mailto:[EMAIL PROTECTED]
Sent: Tuesday, January 20, 2004 3:35 PM
To: [EMAIL PROTECTED]
Subject: Re: Determining what programs are writing into /usr
On Tue, 20 Jan 2004, David Kreuter wrote:
> Hi: What methods are available for determining what is writing into
> /usr and it's subdirectories? Goal is to create a r/o /usr for sharing
> amongst multiple vm linux images. os is suse sles8.
> Thanks,
> David
>
fuser -m /usr
/usr: 176m 197e 214 254e 255e 256e 267e 269e
275e 283e 356m 359e 369e 372e 389e 1319e 1321e 1322c 4445e
4447e 4448c 9451e 9452e 9453e 9454e 9455e 9507e 11614e 11859m
You can probably ignore the ones with e and m. Open file is what you're
looking for.
c current directory.
e executable being run.
f open file. f is omitted in default display mode.
r root directory.
m mmap'ed file or shared library.
lsof can find this out too, it lists all the open files. Identifying the
files of interest requires one to eliminate all the mmaped libraries and
executables being run. lsof does list the filenames that are opened, which
is useful.
lsof +f -- /usr | grep -v '\.so'
</snip>
--
Sam Chessman chessman (a) tux.org
First do what's necessary, then what's possible, finally the impossible.
