Finding out which files a process has open
It is sometimes useful to be able to find out which files a
process has open. This may be because a program will
run on one system but not on another. You may suspect that
the permissions on a file or directory are preventing the program
from running but you are uncertain as to which files it uses.
shows how entries in the file descriptor array
u_ofile) in each process's u-area
point to entries in the open file table. Each entry in the open
file table points to an entry in the generic in-core inode table.
Note that a slot number in the in-core inode table is not the
same (unless coincidentally) as the inode number of the
associated file in the filesystem.
Figure D-1 The relationship between the file descriptor table of a process and the system open file and in-core inode tables
To find which files are open to a process, you must trace a path from the file descriptor table of a process to the in-core inode table. You can then use the nodnm(ADM) and ncheck(ADM) commands to find the filesystem to which the inode belongs and to relate one or more filenames to the inode.
Procslot = slot
PER PROCESS USER AREA FOR PROCESSslot
OPEN FILES AND POFILE FLAGS:
[ 0]: F#3 [ 1]: F#10 w [ 2]: F#10 w
[ 3]: F#7 r
The standard input (file descriptor 0) references entry 3 in the file table.
Both the standard output and standard error output have opened entry 10
(file descriptor 2 is a duplicate of file
descriptor 1), and file descriptor 3 references entry 7.
w flags show if the process has
the files open for reading or writing, or both; the
shows a file descriptor that will be closed on an
file 3 10 7FILE TABLE SIZE = 341 SLOT RCNT I/FL OFFSET FLAGS 3 1 I# 267 0 read 10 4 I# 291 94 write append 7 1 I# 2 0 read write
>From this, it can be seen that the in-core inode slot 267 refers to inode number 45 in the filesystem whose device node has major and minor device numbers 1 and 40. Other information that may be of interest is that inode number 46 has three hard links that reference it (
inode 267 291 2INODE TABLE SIZE = 161 SLOT MAJ/MIN FS INUMB RCNT LINK UID GID SIZE MODE MNT M/ST FLAGS 267 1,40 1 45 7 1 0 3 0 c---666 0 S 0 - 291 1,40 1 46 1 3 2 15 0 c---600 0 S 0 - 2 1,40 1 171 1 1 9 16 0 p---060 0 S 0 -
LINK= 3), and inode number 45 has seven references to it in the file table (
The modes for both inodes 45 and 46 begin with ``c''; this
shows that the files are character special devices. Inode 171's
mode begins with a ``p'' indicating that it is a named pipe.
A regular file's mode would begin with a ``f''; see the
manual page for a list of other mode character codes.
>This shows that the filesystem that corresponds to device major number 1 and minor number 40 is /dev/root.
!/etc/nodnm b 1 40/dev/root >
!/etc/nodnm c 1 40/dev/rroot
!ncheck -i 45 46 171 /dev/root/dev/root: 45 /dev/null 46 /dev/console 46 /dev/syscon 46 /dev/systty 171 /usr/lib/cron/FIFO