Re: How can I know which files a proccess is accessing?
Dan Nelson wrote: In the last episode (Jun 09), Ulrich Spoerlein said: Sadly, ktrace(1) seems to be rather useless in RELENG_6 right now. Every medium sized app will result in an out of ktrace objects error. I remember that some improvements to ktrace(1) went into -CURRENT. Time for an MFC? Just raise the kern.ktrace.request_pool sysctl; 4096 works for me. Heh, I didn't know that sysctl existed. Why is the default value (100) so low? I set it to 4096, but it only survives three seconds when running 'ktrace find ~' Anyway, next time I need ktrace, I'll remember to bump the pool size. Thanks! Ulrich Spoerlein -- PGP Key ID: 20FEE9DD Encrypted mail welcome! Fingerprint: AEC9 AF5E 01AC 4EE1 8F70 6CBD E76E 2227 20FE E9DD Which is worse: ignorance or apathy? Don't know. Don't care. pgpktFWAqYki3.pgp Description: PGP signature
Re: How can I know which files a proccess is accessing?
Robert Watson wrote: A lot of people have answered and told you about lsof, which is a great tool, and can give you a momentary snapshot of the files a process has open. You might also be interested in getting a log of accesses, which you can do using ktrace(1). This tracks system calls and you can see what paths are being accessed at time of open. As of 7.x (and hopefully 6.2 once the MFC happens) you'll also be able to use audit(4) to track access of files by processes. Sadly, ktrace(1) seems to be rather useless in RELENG_6 right now. Every medium sized app will result in an out of ktrace objects error. I remember that some improvements to ktrace(1) went into -CURRENT. Time for an MFC? Ulrich Spoerlein -- PGP Key ID: 20FEE9DD Encrypted mail welcome! Fingerprint: AEC9 AF5E 01AC 4EE1 8F70 6CBD E76E 2227 20FE E9DD Which is worse: ignorance or apathy? Don't know. Don't care. pgpqxY87H4unN.pgp Description: PGP signature
Re: How can I know which files a proccess is accessing?
Michael Hall wrote:
Yes, it does look handy, another new usage for 'find'.
Typically a 'grep ... | awk ...' can be combined, resulting in a small
improvement:
fstat | awk '/httpd.*\/var/ { print $6 }' | xargs ...
Won't buy you anything though: processing is I/O bounded.
Ulrich Spoerlein
--
PGP Key ID: 20FEE9DD Encrypted mail welcome!
Fingerprint: AEC9 AF5E 01AC 4EE1 8F70 6CBD E76E 2227 20FE E9DD
Which is worse: ignorance or apathy?
Don't know. Don't care.
pgpgv1X2P2mtd.pgp
Description: PGP signature
Re: How can I know which files a proccess is accessing?
In the last episode (Jun 09), Ulrich Spoerlein said: Robert Watson wrote: A lot of people have answered and told you about lsof, which is a great tool, and can give you a momentary snapshot of the files a process has open. You might also be interested in getting a log of accesses, which you can do using ktrace(1). This tracks system calls and you can see what paths are being accessed at time of open. As of 7.x (and hopefully 6.2 once the MFC happens) you'll also be able to use audit(4) to track access of files by processes. Sadly, ktrace(1) seems to be rather useless in RELENG_6 right now. Every medium sized app will result in an out of ktrace objects error. I remember that some improvements to ktrace(1) went into -CURRENT. Time for an MFC? Just raise the kern.ktrace.request_pool sysctl; 4096 works for me. -- Dan Nelson [EMAIL PROTECTED] ___ freebsd-stable@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-stable To unsubscribe, send any mail to [EMAIL PROTECTED]
Re: How can I know which files a proccess is accessing?
On Fri, 9 Jun 2006, Ulrich Spoerlein wrote: Robert Watson wrote: A lot of people have answered and told you about lsof, which is a great tool, and can give you a momentary snapshot of the files a process has open. You might also be interested in getting a log of accesses, which you can do using ktrace(1). This tracks system calls and you can see what paths are being accessed at time of open. As of 7.x (and hopefully 6.2 once the MFC happens) you'll also be able to use audit(4) to track access of files by processes. Sadly, ktrace(1) seems to be rather useless in RELENG_6 right now. Every medium sized app will result in an out of ktrace objects error. I remember that some improvements to ktrace(1) went into -CURRENT. Time for an MFC? I fixed this in 7-CURRENT, I'll have to investigate how straight forward an MFC might be. It does change the kernel thread data structure, so I'll need to be a bit cautious. Robert N M Watson ___ freebsd-stable@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-stable To unsubscribe, send any mail to [EMAIL PROTECTED]
Re: How can I know which files a proccess is accessing?
On 06/06/06 15:39, Eduardo Meyer wrote: Hello, I need to know which files under /var a proccess (httpd here) is acessing. It is not logs because I have a different partition for logs. gstat tells me that slice ad0s1h (my /var) is 100% frequently, and in fact with fstat I can see a number of httpd proccesses running accesing that. But fstat only shows me inodes and the mount point. I need to know which files the proccesses are acessing. How? Just in case you didn't get enough responses Here's a *great* article: http://www.onlamp.com/pub/a/bsd/2002/09/26/Big_Scary_Daemons.html?page=1 Thank you. ___ freebsd-stable@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-stable To unsubscribe, send any mail to [EMAIL PROTECTED] -- Regards, Eric ___ freebsd-stable@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-stable To unsubscribe, send any mail to [EMAIL PROTECTED]
Re: How can I know which files a proccess is accessing?
Note that problems with lsof are generally fixed by recompiling it. It
doesn't take well to upgrades of the OS underneath it.
On 6/7/06, Michael Hall [EMAIL PROTECTED] wrote:
On Wed, Jun 07, 2006 at 08:20:03AM -0700, pete wright wrote:
On 6/6/06, Darren Pilgrim [EMAIL PROTECTED] wrote:
Eduardo Meyer wrote:
Hello,
I need to know which files under /var a proccess (httpd here) is
acessing. It is not logs because I have a different partition for
logs.
gstat tells me that slice ad0s1h (my /var) is 100% frequently, and in
fact with fstat I can see a number of httpd proccesses running
accesing that. But fstat only shows me inodes and the mount point.
I need to know which files the proccesses are acessing.
find(1) can match inodes. A quick example:
fstat | grep 'httpd.*/var ' | awk '{print $6}' | xargs -n 1 sudo
find
-x /var -inum | sort -u
/var/log/httpd-error.log
/var/run/accept.lock.#
/var/tmp/apr8530d5
/var/tmp/aprF2Zs0e
Thanks for the oneliner Darren, that's going in my scripts dir right now
;)
Yes, it does look handy, another new usage for 'find'.
Typically a 'grep ... | awk ...' can be combined, resulting in a small
improvement:
fstat | awk '/httpd.*\/var/ { print $6 }' | xargs ...
--
Why doesn't Buick rhyme with quick?
Mike Hall
San Juan Island, WA
System Admin - Rock Island Communications [EMAIL PROTECTED]
System Admin - riverside.org, ssdd.org [EMAIL PROTECTED]
___
freebsd-stable@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-stable
To unsubscribe, send any mail to [EMAIL PROTECTED]
___
freebsd-stable@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-stable
To unsubscribe, send any mail to [EMAIL PROTECTED]
Re: How can I know which files a proccess is accessing?
It is worth mentioning that lsof is also extremely useful for finding inodes that have a link count of 0, i.e. files that have been deleted but are still open by a process. lsof +L1 will list them with their inode numbers and the PIDs of the processes that keep them open. Best regards Oliver -- Oliver Fromme, secnetix GmbH Co. KG, Marktplatz 29, 85567 Grafing Dienstleistungen mit Schwerpunkt FreeBSD: http://www.secnetix.de/bsd Any opinions expressed in this message may be personal to the author and may not necessarily reflect the opinions of secnetix in any way. Clear perl code is better than unclear awk code; but NOTHING comes close to unclear perl code (taken from comp.lang.awk FAQ) ___ freebsd-stable@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-stable To unsubscribe, send any mail to [EMAIL PROTECTED]
Re: How can I know which files a proccess is accessing?
On Tue, 2006-Jun-06 18:16:39 -0300, Eduardo Meyer wrote: On 6/6/06, David Wolfskill [EMAIL PROTECTED] wrote: You may find the lsof port useful for answering such questions. I tried it, but it seems that I found some limitations: lsof: no local file space at PID 16543 I don't know that exact message but lsof needs to very closely match your running kernel: You should have the kernel sources installed when you build lsof. -- Peter Jeremy ___ freebsd-stable@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-stable To unsubscribe, send any mail to [EMAIL PROTECTED]
Re: How can I know which files a proccess is accessing?
# ps 16543 PID TT STAT TIME COMMAND 16543 ?? S 0:02.43 /usr/local/sbin/httpd -k start -DSSL Any tuning would do the job? Are you running with tightened up security that might prevent fstat from accessing /dev/kmem? I don't know fstat failures from experience or what causes it to just show inode numbers - perhaps delete files that are still open. I'm unsure about the reason for lsof's complaint; if you installed a package, try rebuilding the port. Something different, if fstat and lsof continue to fail: you may try attaching a syscall tracer such as truss, ktrace or strace (the latter from ports) to the process and see if it leaks file descriptors. This may fail due to permissions however. Hello Matthias, No, no security measurements prevent lsof from accessing any device. In fact with lower disk demand (small number of open files) lsof works fine, but in the situation I need it, when the odd things start to happen, it doesnt. If a single proccess is opening hundres of files, lsof fails with the mentioned message. I have tried 2 different versions from lsof, all built from ports (the latest and 2 revisions ago with portdowngrade to be sure it is not a problem that belongs only to the latest version). fstat doesnt fail under the same workload... My wish is that fstat had an option to show file name instead of inodes :) For those who pointed me using find(1) looking for inum from the output of fstat(1), thank you; it is a very heavy loading option (disk usage increases around 30% while doing this) but it seemed to be the interesting option (at least, the options that worded). Again, thank you everybody who replied. ___ freebsd-stable@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-stable To unsubscribe, send any mail to [EMAIL PROTECTED]
Re: How can I know which files a proccess is accessing?
On 6/6/06, Darren Pilgrim [EMAIL PROTECTED] wrote:
Eduardo Meyer wrote:
Hello,
I need to know which files under /var a proccess (httpd here) is
acessing. It is not logs because I have a different partition for
logs.
gstat tells me that slice ad0s1h (my /var) is 100% frequently, and in
fact with fstat I can see a number of httpd proccesses running
accesing that. But fstat only shows me inodes and the mount point.
I need to know which files the proccesses are acessing.
find(1) can match inodes. A quick example:
fstat | grep 'httpd.*/var ' | awk '{print $6}' | xargs -n 1 sudo find
-x /var -inum | sort -u
/var/log/httpd-error.log
/var/run/accept.lock.#
/var/tmp/apr8530d5
/var/tmp/aprF2Zs0e
Thanks for the oneliner Darren, that's going in my scripts dir right now ;)
-pete
--
~~o0OO0o~~
Pete Wright
www.nycbug.org
NYC's *BSD User Group
___
freebsd-stable@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-stable
To unsubscribe, send any mail to [EMAIL PROTECTED]
Re: How can I know which files a proccess is accessing?
On Tue, 6 Jun 2006, Eduardo Meyer wrote: I need to know which files under /var a proccess (httpd here) is acessing. It is not logs because I have a different partition for logs. gstat tells me that slice ad0s1h (my /var) is 100% frequently, and in fact with fstat I can see a number of httpd proccesses running accesing that. But fstat only shows me inodes and the mount point. I need to know which files the proccesses are acessing. A lot of people have answered and told you about lsof, which is a great tool, and can give you a momentary snapshot of the files a process has open. You might also be interested in getting a log of accesses, which you can do using ktrace(1). This tracks system calls and you can see what paths are being accessed at time of open. As of 7.x (and hopefully 6.2 once the MFC happens) you'll also be able to use audit(4) to track access of files by processes. Robert N M Watson ___ freebsd-stable@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-stable To unsubscribe, send any mail to [EMAIL PROTECTED]
Re: How can I know which files a proccess is accessing?
Eduardo Meyer [EMAIL PROTECTED] writes: My wish is that fstat had an option to show file name instead of inodes :) For those who pointed me using find(1) looking for inum from the output of fstat(1), thank you; it is a very heavy loading option (disk usage increases around 30% while doing this) but it seemed to be the interesting option (at least, the options that worded). Note that the filesystem doesn't store any mapping from inode to filename, just the other way around. Therefore, if fstat supported such a function, it would have to do pretty much the same exhaustive search that you are doing with find. ___ freebsd-stable@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-stable To unsubscribe, send any mail to [EMAIL PROTECTED]
Re: How can I know which files a proccess is accessing?
On Wed, Jun 07, 2006 at 08:20:03AM -0700, pete wright wrote:
On 6/6/06, Darren Pilgrim [EMAIL PROTECTED] wrote:
Eduardo Meyer wrote:
Hello,
I need to know which files under /var a proccess (httpd here) is
acessing. It is not logs because I have a different partition for
logs.
gstat tells me that slice ad0s1h (my /var) is 100% frequently, and in
fact with fstat I can see a number of httpd proccesses running
accesing that. But fstat only shows me inodes and the mount point.
I need to know which files the proccesses are acessing.
find(1) can match inodes. A quick example:
fstat | grep 'httpd.*/var ' | awk '{print $6}' | xargs -n 1 sudo find
-x /var -inum | sort -u
/var/log/httpd-error.log
/var/run/accept.lock.#
/var/tmp/apr8530d5
/var/tmp/aprF2Zs0e
Thanks for the oneliner Darren, that's going in my scripts dir right now ;)
Yes, it does look handy, another new usage for 'find'.
Typically a 'grep ... | awk ...' can be combined, resulting in a small
improvement:
fstat | awk '/httpd.*\/var/ { print $6 }' | xargs ...
--
Why doesn't Buick rhyme with quick?
Mike Hall
San Juan Island, WA
System Admin - Rock Island Communications [EMAIL PROTECTED]
System Admin - riverside.org, ssdd.org [EMAIL PROTECTED]
___
freebsd-stable@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-stable
To unsubscribe, send any mail to [EMAIL PROTECTED]
Re: How can I know which files a proccess is accessing?
On Jun 06, Eduardo Meyer wrote: I need to know which files under /var a proccess (httpd here) is acessing. It is not logs because I have a different partition for logs. gstat tells me that slice ad0s1h (my /var) is 100% frequently, and in fact with fstat I can see a number of httpd proccesses running accesing that. But fstat only shows me inodes and the mount point. I need to know which files the proccesses are acessing. Linux has a cool program: lsof (list open files). Does FreeBSD have something similar? -Clint ___ freebsd-stable@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-stable To unsubscribe, send any mail to [EMAIL PROTECTED]
Re: How can I know which files a proccess is accessing?
On Tue, Jun 06, 2006 at 05:39:34PM -0300, Eduardo Meyer wrote.. Hello, I need to know which files under /var a proccess (httpd here) is acessing. It is not logs because I have a different partition for logs. gstat tells me that slice ad0s1h (my /var) is 100% frequently, and in fact with fstat I can see a number of httpd proccesses running accesing that. But fstat only shows me inodes and the mount point. I need to know which files the proccesses are acessing. lsof? $ lsof /var COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME mutt8018 wb4r VREG 0,172 163763 47112 /var/mail/wb sh 8024 wb4r VREG 0,172 163763 47112 /var/mail/wb vi 8025 wb4r VREG 0,172 163763 47112 /var/mail/wb sh 8031 wb4r VREG 0,172 163763 47112 /var/mail/wb $ -- Wilko Bulte [EMAIL PROTECTED] ___ freebsd-stable@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-stable To unsubscribe, send any mail to [EMAIL PROTECTED]
Re: How can I know which files a proccess is accessing?
On 6/6/06, David Wolfskill [EMAIL PROTECTED] wrote: You may find the lsof port useful for answering such questions. I tried it, but it seems that I found some limitations: lsof: no local file space at PID 16543 # ps 16543 PID TT STAT TIME COMMAND 16543 ?? S 0:02.43 /usr/local/sbin/httpd -k start -DSSL Any tuning would do the job? ___ freebsd-stable@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-stable To unsubscribe, send any mail to [EMAIL PROTECTED]
Re: How can I know which files a proccess is accessing?
Hi On Tue, Jun 06, 2006 at 17:39 (-0300), Eduardo Meyer wrote: Hello, I need to know which files under /var a proccess (httpd here) is acessing. It is not logs because I have a different partition for logs. gstat tells me that slice ad0s1h (my /var) is 100% frequently, and in fact with fstat I can see a number of httpd proccesses running accesing that. But fstat only shows me inodes and the mount point. I need to know which files the proccesses are acessing. How? Try with lsof from ports. /Johan K Thank you. ___ freebsd-stable@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-stable To unsubscribe, send any mail to [EMAIL PROTECTED] -- Johan Karlsson mailto:[EMAIL PROTECTED] ___ freebsd-stable@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-stable To unsubscribe, send any mail to [EMAIL PROTECTED]
Re: How can I know which files a proccess is accessing?
Eduardo Meyer [EMAIL PROTECTED] writes: gstat tells me that slice ad0s1h (my /var) is 100% frequently, and in fact with fstat I can see a number of httpd proccesses running accesing that. But fstat only shows me inodes and the mount point. I need to know which files the proccesses are acessing. How? Map the inodes to files with find(1)? ___ freebsd-stable@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-stable To unsubscribe, send any mail to [EMAIL PROTECTED]
Re: How can I know which files a proccess is accessing?
On Tue, 06 Jun 2006 23:14:01 +0200, Clint Olsen [EMAIL PROTECTED] wrote: On Jun 06, Eduardo Meyer wrote: I need to know which files under /var a proccess (httpd here) is acessing. It is not logs because I have a different partition for logs. gstat tells me that slice ad0s1h (my /var) is 100% frequently, and in fact with fstat I can see a number of httpd proccesses running accesing that. But fstat only shows me inodes and the mount point. I need to know which files the proccesses are acessing. Linux has a cool program: lsof (list open files). Does FreeBSD have something similar? /usr/ports/sysutils/lsof -- Ronald Klop Amsterdam, The Netherlands ___ freebsd-stable@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-stable To unsubscribe, send any mail to [EMAIL PROTECTED]
Re: How can I know which files a proccess is accessing?
On 6/6/06, pete wright [EMAIL PROTECTED] wrote: On 6/6/06, Eduardo Meyer [EMAIL PROTECTED] wrote: Hello, I need to know which files under /var a proccess (httpd here) is acessing. It is not logs because I have a different partition for logs. gstat tells me that slice ad0s1h (my /var) is 100% frequently, and in fact with fstat I can see a number of httpd proccesses running accesing that. But fstat only shows me inodes and the mount point. I need to know which files the proccesses are acessing. if you can get fstat to help you may want to take a look at lfof, sorry that should be lsof -pete -- ~~o0OO0o~~ Pete Wright www.nycbug.org NYC's *BSD User Group ___ freebsd-stable@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-stable To unsubscribe, send any mail to [EMAIL PROTECTED]
Re: How can I know which files a proccess is accessing?
On Tue, Jun 06, 2006 at 02:14:01PM -0700, Clint Olsen wrote: ... I need to know which files the proccesses are acessing. Linux has a cool program: lsof (list open files). Does FreeBSD have something similar? lsof never has been Linux-specific. Please see sysutils/lsof in your local ports tree. Peace, david -- David H. Wolfskill [EMAIL PROTECTED] Doing business with spammers only encourages them. Please boycott spammers. See http://www.catwhisker.org/~david/publickey.gpg for my public key. pgpIIHyISESxD.pgp Description: PGP signature
Re: How can I know which files a proccess is accessing?
On Tue, Jun 06, 2006 at 02:14:01PM -0700, Clint Olsen wrote.. On Jun 06, Eduardo Meyer wrote: I need to know which files under /var a proccess (httpd here) is acessing. It is not logs because I have a different partition for logs. gstat tells me that slice ad0s1h (my /var) is 100% frequently, and in fact with fstat I can see a number of httpd proccesses running accesing that. But fstat only shows me inodes and the mount point. I need to know which files the proccesses are acessing. Linux has a cool program: lsof (list open files). Does FreeBSD have something similar? The same: [EMAIL PROTECTED] ~: pkg_info | grep lsof lsof-4.76.2 Lists information about open files (similar to fstat(1)) see: /usr/ports/sysutils/lsof -- Wilko Bulte [EMAIL PROTECTED] ___ freebsd-stable@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-stable To unsubscribe, send any mail to [EMAIL PROTECTED]
Re: How can I know which files a proccess is accessing?
On Tue, Jun 06, 2006 at 02:14:01PM -0700 I heard the voice of Clint Olsen, and lo! it spake thus: Linux has a cool program: lsof (list open files). Does FreeBSD have something similar? fstat. (or lsof in ports, if you wanted) -- Matthew Fuller (MF4839) | [EMAIL PROTECTED] Systems/Network Administrator | http://www.over-yonder.net/~fullermd/ On the Internet, nobody can hear you scream. ___ freebsd-stable@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-stable To unsubscribe, send any mail to [EMAIL PROTECTED]
Re: How can I know which files a proccess is accessing?
On 6/6/06, Eduardo Meyer [EMAIL PROTECTED] wrote: Hello, I need to know which files under /var a proccess (httpd here) is acessing. It is not logs because I have a different partition for logs. gstat tells me that slice ad0s1h (my /var) is 100% frequently, and in fact with fstat I can see a number of httpd proccesses running accesing that. But fstat only shows me inodes and the mount point. I need to know which files the proccesses are acessing. if you can get fstat to help you may want to take a look at lfof, available in ports: /usr/ports/sysutils/lsof Lsof (LiSt Open Files) lists information about files that are open by the running processes. An open file may be a regular file, a directory, a block special file, a character special file, an executing text reference, a library, a stream or a network file (Internet socket, NFS file or Unix domain socket). -pete -- ~~o0OO0o~~ Pete Wright www.nycbug.org NYC's *BSD User Group ___ freebsd-stable@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-stable To unsubscribe, send any mail to [EMAIL PROTECTED]
Re: How can I know which files a proccess is accessing?
On 6/6/06, Eduardo Meyer [EMAIL PROTECTED] wrote: Hello, I need to know which files under /var a proccess (httpd here) is acessing. It is not logs because I have a different partition for logs. [...] check out ./ports/sysutils/lsof. An excellent little util that has become a standard on all of my *NIXish installs. It'll tell you all you ever wanted to know (and more) about which pieces of your OS are touching what. -- Stephen Spencer Lawrence, KS If God dropped acid, would he see people? ___ freebsd-stable@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-stable To unsubscribe, send any mail to [EMAIL PROTECTED]
Re: How can I know which files a proccess is accessing?
On Tuesday 06 June 2006 05:14 pm, Clint Olsen wrote: On Jun 06, Eduardo Meyer wrote: I need to know which files under /var a proccess (httpd here) is acessing. It is not logs because I have a different partition for logs. gstat tells me that slice ad0s1h (my /var) is 100% frequently, and in fact with fstat I can see a number of httpd proccesses running accesing that. But fstat only shows me inodes and the mount point. I need to know which files the proccesses are acessing. Linux has a cool program: lsof (list open files). Does FreeBSD have something similar? http://www.freebsd.org/cgi/cvsweb.cgi/ports/sysutils/lsof/ Jung-uk Kim ___ freebsd-stable@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-stable To unsubscribe, send any mail to [EMAIL PROTECTED]
Re: How can I know which files a proccess is accessing?
On Tue, 6 Jun 2006, Clint Olsen wrote: Linux has a cool program: lsof (list open files). Does FreeBSD have something similar? % cd /usr/ports % make search name=lsof Port: lsof-4.76.1.1 Path: /usr/ports/sysutils/lsof Info: Lists information about open files (similar to fstat(1)) Maint: [EMAIL PROTECTED] B-deps: R-deps: WWW:http://people.freebsd.org/~abe/ -- Brian Tao, Luxography http://www.luxography.ca/ (main) http://blog.luxography.ca/ (blog) The art of light ___ freebsd-stable@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-stable To unsubscribe, send any mail to [EMAIL PROTECTED]
Re: How can I know which files a proccess is accessing?
Clint Olsen wrote:
Linux has a cool program: lsof (list open files). Does FreeBSD have
something similar?
Yes, 'fstat'. Though I very rarely remember its name ('lsof' is far more
memorable, IMHO).
___
freebsd-stable@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-stable
To unsubscribe, send any mail to [EMAIL PROTECTED]
Re: How can I know which files a proccess is accessing?
Eduardo Meyer wrote: Hello, I need to know which files under /var a proccess (httpd here) is acessing. It is not logs because I have a different partition for logs. Is everyone forgetting the command fstat that comes with freebsd? :) ___ freebsd-stable@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-stable To unsubscribe, send any mail to [EMAIL PROTECTED]
Re: How can I know which files a proccess is accessing?
Eduardo Meyer [EMAIL PROTECTED] writes: On 6/6/06, David Wolfskill [EMAIL PROTECTED] wrote: You may find the lsof port useful for answering such questions. I tried it, but it seems that I found some limitations: lsof: no local file space at PID 16543 # ps 16543 PID TT STAT TIME COMMAND 16543 ?? S 0:02.43 /usr/local/sbin/httpd -k start -DSSL Any tuning would do the job? Are you running with tightened up security that might prevent fstat from accessing /dev/kmem? I don't know fstat failures from experience or what causes it to just show inode numbers - perhaps delete files that are still open. I'm unsure about the reason for lsof's complaint; if you installed a package, try rebuilding the port. Something different, if fstat and lsof continue to fail: you may try attaching a syscall tracer such as truss, ktrace or strace (the latter from ports) to the process and see if it leaks file descriptors. This may fail due to permissions however. -- Matthias Andree ___ freebsd-stable@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-stable To unsubscribe, send any mail to [EMAIL PROTECTED]
Re: How can I know which files a proccess is accessing?
Eduardo Meyer wrote:
Hello,
I need to know which files under /var a proccess (httpd here) is
acessing. It is not logs because I have a different partition for
logs.
gstat tells me that slice ad0s1h (my /var) is 100% frequently, and in
fact with fstat I can see a number of httpd proccesses running
accesing that. But fstat only shows me inodes and the mount point.
I need to know which files the proccesses are acessing.
find(1) can match inodes. A quick example:
fstat | grep 'httpd.*/var ' | awk '{print $6}' | xargs -n 1 sudo find
-x /var -inum | sort -u
/var/log/httpd-error.log
/var/run/accept.lock.#
/var/tmp/apr8530d5
/var/tmp/aprF2Zs0e
--
Darren Pilgrim
___
freebsd-stable@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-stable
To unsubscribe, send any mail to [EMAIL PROTECTED]
