How to find opened file by NODE NUMBER

[Satish Kumar Malisetti]

All,

In my application one process id is opening multilple file handlers through application , based on the NODE number can i find which file has been opened

ex :
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME

cor 19891 fwsup01a 78u REG 3,0xa 88 18125768 /fwdev3/data (cbfp0004:/vol/fv_FUSD1_APP04954_cbs_pa_0/qt_FUSD1_APP04954_pa_fwdev3_0)

from FD i can see that it is a rea write REGULAR FILE for the process id 19891 , where as cor is my application process name

from the above can i know what is file handle it is opened and the path ?

please reply me

[Matti_Kurkela · Accepted solution]

The easiest way would be to look at the NAME field. It lists the full pathname of the file or directory. If it's a directory, there's also the device name associated with the filesystem that contains the file.

In this case, it's the directory /fwdev3/data, which seems to be a NFS mount from cbfp0004:/vol/fv_FUSD1_APP04954_cbs_pa_0/qt_FUSD1_APP04954_pa_fwdev3_0.

But if you don't have the name, you would have to first use the DEVICE field to identify the correct device by its major/minor numbers. In this case, the numbers are 3,0xa; so the major number is 3 and the minor number is 0xa in hexadecimal (= 10 in decimal). The minor number is usually expressed in 6-digit form, i.e. 0xa = 0x00000a.

First, you might use "lsdev -e " to identify the type of the device. In this case, run "lsdev -e 3". If the device is, for example, a LVM block device, run "ll /dev/vg* | more" and find the device with the matching minor number. Then use the output of "mount" or "bdf" to find out the mount point of that device.

With NFS devices, the minor device numbers cannot be looked up from /dev, so some guesswork is required.

Once you know the mount point, you can use the mount point and the NODE number (the inode number of the file) with the "find" command to locate the file.

For example, if you knew the mountpoint is /mountpoint and the NODE field is 12345, you would find the file using:

find /mountpoint -inum 12345

MK

[Dennis Handly]

>from the above can I know what is file handle it is opened and the path?

The second line isn't the path?
Basically if 18125768 is the inum, and you know the file system, you can do:
find file-system -inum 18125768

[Satish Kumar Malisetti]

Dennis,

when try to run the given command i am getting error

cbh10702 $
find file-system -inum 18125768
find: cannot stat file-system

[Dennis Handly]

>find: cannot stat file-system

You were suppose to replace "file-system" by the correct file system mount point.

Matti suggested it was: /fwdev3/data

[Satish Kumar Malisetti]

Matti,

I have tried for the scenario gien below and how can i find the mount point

cor 9354 fwsup01a 20u REG 3,0xa 0 6046739 /fwdev3/data (cbfp0004:/vol/fv_FUSD1_APP04954_cbs_pa_0/qt_FUSD1_APP04954_pa_fwdev3_0)


cbh10702 $ /usr/sbin/lsdev -e 3
Character Block Driver Class
2 3 fake pseudo
3 -1 mm pseudo


cbh10702 $ ll /dev/vg* | more
total 0
brw-r----- 1 root sys 64 0x000016 Nov 16 2007 UCPS
brw-r----- 1 root sys 64 0x00000d Oct 28 2008 agent10g
brw-r----- 1 root sys 64 0x000015 Nov 16 2007 condir
brw-r----- 1 root sys 64 0x000017 Nov 16 2007 ecc
brw-r----- 1 root sys 64 0x000014 Nov 16 2007 eco
brw-r----- 1 root sys 64 0x000013 Nov 16 2007 esm
crw-r----- 1 root sys 64 0x000000 Nov 16 2007 group
brw-r----- 1 root sys 64 0x000001 Nov 14 2008 lvol1
brw-r----- 1 root sys 64 0x00000a Nov 16 2007 lvol10
brw-r----- 1 root sys 64 0x00000b Nov 16 2007 lvol11
brw-r----- 1 root sys 64 0x000002 Nov 16 2007 lvol2
brw-r----- 1 root sys 64 0x000003 Nov 16 2007 lvol3
brw-r----- 1 root sys 64 0x000004 Nov 16 2007 lvol4
brw-r----- 1 root sys 64 0x000005 Nov 16 2007 lvol5
brw-r----- 1 root sys 64 0x000006 Nov 16 2007 lvol6
brw-r----- 1 root sys 64 0x000007 Nov 16 2007 lvol7
brw-r----- 1 root sys 64 0x000008 Nov 16 2007 lvol8
brw-r----- 1 root sys 64 0x000009 Nov 16 2007 lvol9
brw-r----- 1 root sys 64 0x00000c Oct 28 2008 oracle
brw-r----- 1 root sys 64 0x000010 Nov 16 2007 osmf
crw-r----- 1 root sys 64 0x000016 Nov 16 2007 rUCPS
crw-r----- 1 root sys 64 0x00000d Oct 28 2008 ragent10g
crw-r----- 1 root sys 64 0x000015 Nov 16 2007 rcondir
crw-r----- 1 root sys 64 0x000017 Nov 16 2007 recc
crw-r----- 1 root sys 64 0x000014 Nov 16 2007 reco
crw-r----- 1 root sys 64 0x000013 Nov 16 2007 resm
crw-r----- 1 root sys 64 0x000001 Nov 16 2007 rlvol1
crw-r----- 1 root sys 64 0x00000a Nov 16 2007 rlvol10
crw-r----- 1 root sys 64 0x00000b Nov 16 2007 rlvol11
crw-r----- 1 root sys 64 0x000002 Nov 16 2007 rlvol2
crw-r----- 1 root sys 64 0x000003 Nov 16 2007 rlvol3
crw-r----- 1 root sys 64 0x000004 Nov 16 2007 rlvol4
crw-r----- 1 root sys 64 0x000005 Nov 16 2007 rlvol5
crw-r----- 1 root sys 64 0x000006 Nov 16 2007 rlvol6
crw-r----- 1 root sys 64 0x000007 Nov 16 2007 rlvol7
crw-r----- 1 root sys 64 0x000008 Nov 16 2007 rlvol8
crw-r----- 1 root sys 64 0x000009 Nov 16 2007 rlvol9
crw-r----- 1 root sys 64 0x00000c Oct 28 2008 roracle
crw-r----- 1 root sys 64 0x000010 Nov 16 2007 rosmf
crw-r----- 1 root sys 64 0x000012 Nov 16 2007 rsched
crw-r----- 1 root sys 64 0x000011 Nov 16 2007 rxfer
brw-r----- 1 root sys 64 0x000012 Nov 16 2007 sched
brw-r----- 1 root sys 64 0x000011 Nov 16 2007 xfer

I didn't get this statement

Then use the output of "mount" or "bdf" to find out the mount point of that device.

how to use this

[Satish Kumar Malisetti]

Dennis,Matti

really tnaks for the help now i can find where what is the file handle is opened

thanks alot

[James R. Ferguson]

Hi:

You should be aware that an inode number is only unique within a filesystem. Hence, be sure to search for a file by inode number by explicitly restricting your search to the mounted filesystem in question. It is advisable to do something like:

# find /path -inum 1234 -exec ls -ld {} +

The '-xdev' argument prevents find() from crossing mountpoints.

Regards!

...JRF...

[Dennis Handly]

>JRF: It is advisable to do something like:
# find /path -inum 1234 -exec ls -ld {} +
>The '-xdev' argument

Yes, I ran into that when I was testing it. No need for -exec unless you were trying to show multiple files.
find /path -xdev -inum 1234
Then "ll -id" for the path you found.

[Satish Kumar Malisetti]

Thanks alot guys