On Wed, Aug 12, 2009 at 1:17 AM, patrick keshishian<[email protected]> wrote: >> fstat reports on open files, not files in use. as you've discovered, >> there are ways for a file to be in use without being open by a >> process. > > This seems educational; could you please elaborate?
The kernel keeps a list of all processes, and each process keeps a list of files it has open. So this is how fstat works. At a lower level, the files for filesystem objects are backed by vnodes in the kernel, which are reference counted. When you unmount a filesystem, the kernel checks the reference count and if it's still busy, it tells you so. But there's no global list of vnodes for fstat to walk; as long as they are refcounted, vnodes can be stashed anywhere. vnconfig, core dumps, acct, and ktrace come to mind as files that the kernel would be operating on via vnodes that don't have an open process.
