lsof - I want to see the file accessed -

[steven Burgess_2]

Hi all

I'm currently attempting to see the files accessed at any one time by a user

The thing is I only get something like

COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
prorun 1919 E817PJH cwd VDIR 64,0x30001 48128 4633 /usr1 (/dev/vg03/lvol)
prorun 1919 E817PJH txt VREG 64,0x10004 159744 825 /usr (/dev/vg01/lvol42
prorun 1919 E817PJH 1u VCHR 157,0x2 0t416886 592 /dev/pts/2
prorun 1919 E817PJH 2u VCHR 157,0x2 0t416886 592 /dev/pts/2

We have an application that uses C-ISAM files as opposed to a database, using glance I can see the file system PID,UID using most resources etc but I can't drill down to actual file level

Can I make an ammendment to characters per line or similar to allow me to see if this or is there another way ?

Thanks in advance

Steve

[John Poff]

Hi Steve,

Glance gives you the lvol and the inode, so you can use find to get the filename from there. Say your /dev/vg03/lvol is /somefs and the inode from Glance is 4633:

find /somefs -inum 4633

JP

[harry d brown jr]

c-isam files are JUST flat files. Nothing special there. So if they don't have them open, then you won't see them.

live free or die
harry

[steven Burgess_2]

Hi

Thats the thing, the files are accessed that quicly the PID doesn't hang around long enough for me to track. If I get a user to perform a function I want to be able to leave a trace open for his ID and view all the files being accessed, a bit like tusc does with system calls.

Steve

[John Poff · Accepted solution]

I wrote Glance in my reply because I have Glance on my brain today, but the inodes work the same way from lsof output.

I have version 4.6.4 of lsof, and the man page says you can specify a repeat interval in seconds using the -r option. Have you tried using lsof with a -r 1 option and also specifying the directory that contains just the ISAM files in question? That might limit it enough so that lsof could catch one of the instances of the file being accessed. You could try something like this:

lsof -r 1 /somefs/dir

JP

[steven Burgess_2]

Hi

The NODE is the INODE of the file

Ace

Thanks

Steve