From: noldi@furka.enet.dec.com (Arnold Sutter Unix Support)
Subject: Re: How to find all processes with open files ? 
Reply-To: noldi@furka.zuo.dec.com
Organization: Digital Equipment Corporation, Zurich, Switzerland
Date: Mon, 14 Dec 1992 17:56:05 GMT


--
Hello there again, 

Some time ago I was asking a way to tell what files are open by what 
processes. 

Some people have suggested to use fuser. This gives you all the processes
that have files open on any given partition but it doesn't give you the 
exact file names. At the end I'm including a script that uses 
fuser/crash/ncheck to find the way to the filename. 

Try it out!

Regards, 

Arnold
----------------------------------------------------------------------------
Arnold Sutter, DEC Unix Support, Zurich, Switzerland
I-net:  noldi@furka.enet.dec.com
X.400:  C=ch, A=arcom, P=digital, O=digital, OU=rle, S=sutter, G=arnold
Phone:  [++](411) 801-2714
Motto:  "Who are you ?? -- I'm BATMAN !!"
----------------------------------------------------------------------------
Script started on Mon Dec 14 16:52:52 1992
calyx:/ > 
calyx:/ > 
calyx:/ > id
uid=0(root) gid=1(other)
calyx:/ > echo "U must be root ..."
U must be root ...
calyx:/ > 
calyx:/ > df
/         (/dev/root        ):    48606 blocks    28558 i-nodes
/pcsaserv (/dev/pcsa        ):   149418 blocks    27299 i-nodes
/u        (/dev/u           ):   162594 blocks    20650 i-nodes
calyx:/ > 
calyx:/ > 
calyx:/ > echo "See what files are open on a partition ..."
See what files are open on a partition ...
calyx:/ > 
calyx:/ > fuser /dev/u
/dev/u:     4135c    4955c    4976c    4976
calyx:/ > 
calyx:/ > ps -tp 4976
   PID  TTY      TIME COMMAND
  4976  p1       0:00 cat
calyx:/ > 
calyx:/ > echo "This is a process that has a file open ..."
This is a process that has a file open ...
calyx:/ > 
calyx:/ > crash
dumpfile = /dev/mem, namelist = /unix, outfile = stdout
> p #4976
PROC TABLE SIZE = 800
SLOT ST PID   PPID  PGRP   UID PRI CPU   EVENT     NAME        FLAGS
  68 s  4976  4955  4955   731  28   0 f013c49c cat            load ntrc
> 
> 
> !echo look at user block data for that process slot 
look at user block data for that process slot
> u 68
PER PROCESS USER AREA FOR PROCESS 68
USER ID's:      uid: 731, gid: 200, real uid: 731, real gid: 200
        supplementary gids: 200 50
PROCESS TIMES:  user: 1, sys: 12, child user: 0, child sys: 0
PROCESS MISC:
        command: cat, psargs: cat 
        proc slot: 68, cntrl tty:  58,1  
        start: Mon Dec 14 16:50:38 1992
        mem: 1e, type: exec
        proc/text lock: none
        inode of current directory: 1697
OPEN FILES AND POFILE FLAGS:
          [ 0]: F#245   r    [ 1]: F#241     w  [ 2]: F#245      
FILE I/O:
        u_base:   402b44, file offset: 1099, bytes: 1024,
        segment: data, cmask: 0022, ulimit: 2097152
        file mode(s): read write
SIGNAL DISPOSITION:
        sig#  signal   oldmask sigmask

> !echo now you have the open files pointer
now you have the open files pointer
> 
> f 241
FILE TABLE SIZE = 3000
SLOT  RCNT  I/FL   OFFSET  FLAGS
 241     1  I 35        21 write
> f 245
FILE TABLE SIZE = 3000
SLOT  RCNT  I/FL   OFFSET  FLAGS
 245     6  I1372       44b read write
> 
> !echo These file entries have a pointer to the inode table (I/FL column!)
> 
> i 35
INODE TABLE SIZE = 2000
SLOT MAJ/MIN FS INUMB RCNT LINK  UID   GID    SIZE     MODE  MNT M/ST RCVD FLAGS
  35   1,105  2    38    1    1   731   200       33 f---644   2   -    - 
> 
> 
> echo Hey presto! You get here the maj./min. numbers of the device and the INUMB of the file (mode tells you that this is a real file!)
unrecognized function name
> 
> calyx:/ > 
calyx:/ > 
calyx:/ > ls -al /dev/*u
crw-r-----   1 sysinfo  sysinfo    1,105 Nov 09 10:51 /dev/ru
brw-r-----   1 sysinfo  sysinfo    1,105 Nov 23 18:53 /dev/u
calyx:/ > 
calyx:/ > echo "Major/Minor numbers of device"
Major/Minor numbers of device
calyx:/ > 
calyx:/ > ncheck -i 38 /dev/u
/dev/u:
38      /noldi/foo.bar
calyx:/ > 
calyx:/ > echo "This is the file on that partition !!!"
calyx:/ > 
calyx:/ > echo "OK, this was it, bye."
OK, this was it, bye.
calyx:/ > date
Mon Dec 14 17:00:34 MEZ 1992
calyx:/ > 
script done on Mon Dec 14 17:00:35 1992