lsof vs sar -v

[PARENT_3]

on my hpux, i want to know witch files are opened.
when i do:
sar -v : i have 17000 opened files.
But when i use lsof:
lsof |wc -l : i have 10000 opened files....
And 10 000 != 17000 ...why ???

[Stefan Farrelly]

sar -v 1 1 shows the size of the kernel table which is a cache table. This means its displaying the maximum size the cache table has grown to since last reboot - it is NOT the current number of open files in use at the time you run sar. If you run this command just after a reboot and compare to the lsof command below they should be much closer to each other.

lsof is more accurate to show the current number of open files - but it may show a single file open for many processes - artifically inflating the results, so you need to modify the lsof command to filter out duplicates;

lsof | awk '{print $9}' | sort -u | wc -l

This gives the current number of unique open files - which should always be lower than sar -v reports.

[Wodisch]

Hi "parent",

the kernel table contains one entry for every handle into a file, so if one process has a file open in two places, that takes two entries (or two processes having the same file open).
Take your shell as an example:
- one process
- one terminal (tty)
- three "handles" all using the same file (stdin/stdout/stderr all go to your tty)

HTH,
Wodisch

[Dietmar Konermann]

Hi!

You have a system wide file table, sized by tunable nfile. The sar -v output gets the number of currently used slots of this file table... it uses pstat_getdynamic() to get the psd_activefiles metric. This has nothing to do with caching... the metric is accurate and actually indicates when "File table overflow" (ENFILE) would occure.

The lsof goes the other way round, starting from the processes file descriptors (not global) which may reference file table slots.

I never saw both reporting exaclty the same, but similar values using this:

# lsof +ff | cut -c 38-47 | sort -u | wc -l

... where +ff adds the FILE-ADDR to the output.

Best regards...
Dietmar.