Date: Wed, 7 Jun 2006 08:20:03 -0700 From: "pete wright" <nomadlogic@gmail.com> To: "Darren Pilgrim" <darren.pilgrim@bitfreak.org> Cc: stable@freebsd.org, Eduardo Meyer <dudu.meyer@gmail.com> Subject: Re: How can I know which files a proccess is accessing? Message-ID: <57d710000606070820j6291f74el6b6880e681899904@mail.gmail.com> In-Reply-To: <4486574F.9040108@bitfreak.org> References: <d3ea75b30606061339u55efbecemab0d3d0eb9adb636@mail.gmail.com> <4486574F.9040108@bitfreak.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On 6/6/06, Darren Pilgrim <darren.pilgrim@bitfreak.org> wrote:
> Eduardo Meyer wrote:
> > Hello,
> >
> > I need to know which files under /var a proccess (httpd here) is
> > acessing. It is not logs because I have a different partition for
> > logs.
> >
> > gstat tells me that slice ad0s1h (my /var) is 100% frequently, and in
> > fact with fstat I can see a number of httpd proccesses running
> > accesing that. But fstat only shows me inodes and the mount point.
> >
> > I need to know which files the proccesses are acessing.
>
> find(1) can match inodes. A quick example:
>
> > fstat | grep 'httpd.*/var ' | awk '{print $6}' | xargs -n 1 sudo find
> -x /var -inum | sort -u
> /var/log/httpd-error.log
> /var/run/accept.lock.#
> /var/tmp/apr8530d5
> /var/tmp/aprF2Zs0e
>
Thanks for the oneliner Darren, that's going in my scripts dir right now ;)
-pete
--
~~o0OO0o~~
Pete Wright
www.nycbug.org
NYC's *BSD User Group
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?57d710000606070820j6291f74el6b6880e681899904>