From owner-freebsd-questions@FreeBSD.ORG Thu Mar 23 06:49:51 2006 Return-Path: X-Original-To: freebsd-questions@freebsd.org Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id AAB6616A400 for ; Thu, 23 Mar 2006 06:49:51 +0000 (UTC) (envelope-from dan@dan.emsphone.com) Received: from dan.emsphone.com (dan.emsphone.com [199.67.51.101]) by mx1.FreeBSD.org (Postfix) with ESMTP id 5B02843D45 for ; Thu, 23 Mar 2006 06:49:51 +0000 (GMT) (envelope-from dan@dan.emsphone.com) Received: (from dan@localhost) by dan.emsphone.com (8.13.1/8.13.4) id k2N6noaL040586; Thu, 23 Mar 2006 00:49:50 -0600 (CST) (envelope-from dan) Date: Thu, 23 Mar 2006 00:49:50 -0600 From: Dan Nelson To: "Eugene M. Minkovskii" Message-ID: <20060323064950.GC42429@dan.emsphone.com> References: <20060323064720.GA24994@mccme.ru> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20060323064720.GA24994@mccme.ru> X-OS: FreeBSD 5.5-PRERELEASE X-message-flag: Outlook Error User-Agent: Mutt/1.5.11 Cc: freebsd-questions@freebsd.org Subject: Re: how to locate file by inode? X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Mar 2006 06:49:51 -0000 In the last episode (Mar 23), Eugene M. Minkovskii said: > Does anybody know how to locate file by inode? For example, using > fstat(1) I see: > > USER CMD PID FD MOUNT INUM MODE SZ|DV R/W > ... > user some_program 84130 0 /dev 68 crw--w---- ttyp0 rw > user some_program 84130 1 /usr 595890 -rw-r--r-- 0 w > user some_program 84130 2 /dev 68 crw--w---- ttyp0 rw > ... > > I see that some_program using file whith inode 595890 on mount point > /usr like STDOUT. To find it I do following: > > $ find -x /usr -inum 595890 > > to find two files: > > $ find -x /usr \( -inum 595890 -o -inum $other_inum \) -ls > > but this is too slow. Does any body know other, more directly > method? Not in the general case. If the process still has the file open, though, lsof (in ports) might be able to print the filename by digging through the kernel's name cache. Oddly enough, lsof on my 5.4 box is able to resolve filenames for all open fds, even ones I know I have never used (lpd's lockfile, for example :) # lsof -c lpd COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME lpd 532 root cwd VDIR 4,16 1024 2 / lpd 532 root rtd VDIR 4,16 1024 2 / lpd 532 root txt VREG 4,20 72180 784475 /usr/sbin/lpd lpd 532 root txt VREG 4,16 443266 21269 /libexec/ld-elf.so.1 lpd 532 root txt VREG 4,16 2610745 21248 /lib/libc.so.5 lpd 532 root 0u VCHR 2,2 0t0 18 /dev/null lpd 532 root 1u VCHR 2,2 0t0 18 /dev/null lpd 532 root 2u VCHR 2,2 0t0 18 /dev/null lpd 532 root 3u unix 0xc286aa20 0t0 ->0xc27643cc lpd 532 root 4wW VREG 4,19 4 639 /var/spool/output/lpd.lock lpd 532 root 5u unix 0xc286e144 0t0 /var/run/printer lpd 532 root 6u IPv4 0xc288e8ac 0t0 TCP *:printer (LISTEN) -- Dan Nelson dnelson@allantgroup.com