Fstat
fstat is a command similar to the lsof command Linux users are familiar with. Simply put, it returns a list of all open files and what user context they've been opened in. Handy arguments:
fstat -f /usr/local/etc - only return locked files from the filesystem containing /usr/local/etc/ (/usr, on most systems) fstat /usr/local/sbin/smbd - only return info on processes and users locking the file /usr/local/sbin/smbd.
Contents |
File System
To determine the file status for a particular file system the option -f directory or filename is used. For example '/var/log/maillog':
%fstat -f /var/log/maillog USER CMD PID FD MOUNT INUM MODE SZ|DV R/W root cron 3158 wd /var 23552 drwxr-x--- 512 r www httpd 9107 2 /var 471057 -rw-r--r-- 812160 w www httpd 9107 6 /var 471057 -rw-r--r-- 812160 w www httpd 9107 7 /var 471058 -rw-r--r-- 468741 w www httpd 9107 10 /var 541700 -rw------- 0 w www httpd 9107 11 /var 541700 -rw------- 0 w root cron 684 wd /var 23552 drwxr-x--- 512 r root cron 684 3 /var 541727 -rw------- 3 w smmsp sendmail 677 wd /var 1036294 drwxrwx--- 512 r smmsp sendmail 677 4 /var 1036296 -rw------- 49 w root sendmail 671 wd /var 1036291 drwxr-xr-x 512 r root sendmail 671 5 /var 541720 -rw------- 78 w mysql mysqld 649 wd /var 70809 drwx------ 512 r mysql mysqld 649 1 /var 71171 -rw-rw---- 1736 w mysql mysqld 649 2 /var 71171 -rw-rw---- 1736 w root syslogd 501 3 /var 541715 -rw------- 3 w root syslogd 501 11 /var 471068 -rw-r--r-- 194 w root syslogd 501 12 /var 471052 -rw------- 59 w root syslogd 501 13 /var 471045 -rw------- 5444 w
Note: this does not determine the file status of the specified directory or filename but the file status on the file system that particular item resides upon. In the case of this example /var was the underlying file system. To determine the actual user or process using a specific file use the lsof command.
Process
To determine the file status for a particular process the option -p pid-number is used. For example assuming sendmail is assigned a pid of 677 (determined from the ps commend):
%fstat -p 677 USER CMD PID FD MOUNT INUM MODE SZ|DV R/W smmsp sendmail 677 root / 2 drwxr-xr-x 512 r smmsp sendmail 677 wd /var 1036294 drwxrwx--- 512 r smmsp sendmail 677 text /usr 3014716 -r-xr-sr-x 583680 r smmsp sendmail 677 0 /dev 6 crw-rw-rw- null r smmsp sendmail 677 1 /dev 6 crw-rw-rw- null w smmsp sendmail 677 2 /dev 6 crw-rw-rw- null w smmsp sendmail 677 3* local dgram c23b49d8 <-> c23b4dac smmsp sendmail 677 4 /var 1036296 -rw------- 49 w
User
To determine the file status for a particular user the option -u username is used. For example when used against user account 'joeuser':
%fstat -u joeuser USER CMD PID FD MOUNT INUM MODE SZ|DV R/W joeuser fstat 96741 root / 2 drwxr-xr-x 512 r joeuser fstat 96741 wd /usr 2378753 drwxr-xr-x 512 r joeuser fstat 96741 text /usr 2308260 -r-xr-sr-x 14340 r joeuser fstat 96741 0 /dev 93 crw--w---- ttyp0 rw joeuser fstat 96741 1 /dev 93 crw--w---- ttyp0 rw joeuser fstat 96741 2 /dev 93 crw--w---- ttyp0 rw joeuser fstat 96741 3 /dev 26 crw-r----- mem r joeuser fstat 96741 4 /dev 27 crw-r----- kmem r joeuser fstat 96741 5 / 25179 -rw-r--r-- 40960 r joeuser csh 760 root / 2 drwxr-xr-x 512 r joeuser csh 760 wd /usr 2378753 drwxr-xr-x 512 r joeuser csh 760 text / 16628 -r-xr-xr-x 293060 r joeuser csh 760 15 /dev 93 crw--w---- ttyp0 rw joeuser csh 760 16 /dev 93 crw--w---- ttyp0 rw joeuser csh 760 17 /dev 93 crw--w---- ttyp0 rw joeuser csh 760 18 /dev 93 crw--w---- ttyp0 rw joeuser csh 760 19 /dev 93 crw--w---- ttyp0 rw joeuser sshd 759 root / 2 drwxr-xr-x 512 r joeuser sshd 759 wd / 2 drwxr-xr-x 512 r joeuser sshd 759 text /usr 1318917 -r-xr-xr-x 180452 r joeuser sshd 759 0 /dev 6 crw-rw-rw- null rw joeuser sshd 759 1 /dev 6 crw-rw-rw- null rw joeuser sshd 759 2 /dev 6 crw-rw-rw- null rw joeuser sshd 759 3* internet stream tcp c23cf1d0 joeuser sshd 759 4* local stream c23b47a8 <-> c23b4c94 joeuser sshd 759 5* pipe c2335660 <-> c2335718 0 rw joeuser sshd 759 6* pipe c2335718 <-> c2335660 0 rw joeuser sshd 759 7 /dev 92 crw-rw-rw- ptyp0 rw joeuser sshd 759 8 /dev 92 crw-rw-rw- ptyp0 rw joeuser sshd 759 9 /dev 92 crw-rw-rw- ptyp0 rw
