Fstat
The fstat command is used to determine the status of file system objects (directories and files) in use by users and processes. It is similar in purpose to the GNU Project's lsof command.
The output from 'fstat' is very detailed and includes the user name, command or running process (often called a daemon or background service) and its associated pid number. It also shows the finer details of the file system including the I-Node, access permissions and size of the object.
The following sections demonstrate the command with example output.
Contents |
File Name
To determine the file status for a particular file the option filename (with no '-option') is used. For example '/var/log/maillog':
%fstat /var/log/maillog USER CMD PID FD MOUNT INUM MODE SZ|DV R/W NAME root syslogd 501 14 /var 471071 -rw-r----- 31781 w /var/log/maillog
Note: this differs from the File System command below.
File System
To determine the file status for a particular file system the option -f directory or filename is used. For example '/var/log/maillog':
%fstat -f /var/log/maillog USER CMD PID FD MOUNT INUM MODE SZ|DV R/W root cron 3158 wd /var 23552 drwxr-x--- 512 r www httpd 9107 2 /var 471057 -rw-r--r-- 812160 w www httpd 9107 6 /var 471057 -rw-r--r-- 812160 w www httpd 9107 7 /var 471058 -rw-r--r-- 468741 w www httpd 9107 10 /var 541700 -rw------- 0 w www httpd 9107 11 /var 541700 -rw------- 0 w root cron 684 wd /var 23552 drwxr-x--- 512 r root cron 684 3 /var 541727 -rw------- 3 w smmsp sendmail 677 wd /var 1036294 drwxrwx--- 512 r smmsp sendmail 677 4 /var 1036296 -rw------- 49 w root sendmail 671 wd /var 1036291 drwxr-xr-x 512 r root sendmail 671 5 /var 541720 -rw------- 78 w mysql mysqld 649 wd /var 70809 drwx------ 512 r mysql mysqld 649 1 /var 71171 -rw-rw---- 1736 w mysql mysqld 649 2 /var 71171 -rw-rw---- 1736 w root syslogd 501 3 /var 541715 -rw------- 3 w root syslogd 501 11 /var 471068 -rw-r--r-- 194 w root syslogd 501 12 /var 471052 -rw------- 59 w root syslogd 501 13 /var 471045 -rw------- 5444 w
Note: this does not determine the file status of the specified directory or filename but the file status on the file system that particular item resides upon. In the case of this example /var was the underlying file system. To determine the actual user or process using a specific file use the 'File Name' method above.
Process
To determine the file status for a particular process the option -p pid-number is used. For example assuming sendmail is assigned a pid of 677 (determined from the ps commend):
%fstat -p 677 USER CMD PID FD MOUNT INUM MODE SZ|DV R/W smmsp sendmail 677 root / 2 drwxr-xr-x 512 r smmsp sendmail 677 wd /var 1036294 drwxrwx--- 512 r smmsp sendmail 677 text /usr 3014716 -r-xr-sr-x 583680 r smmsp sendmail 677 0 /dev 6 crw-rw-rw- null r smmsp sendmail 677 1 /dev 6 crw-rw-rw- null w smmsp sendmail 677 2 /dev 6 crw-rw-rw- null w smmsp sendmail 677 3* local dgram c23b49d8 <-> c23b4dac smmsp sendmail 677 4 /var 1036296 -rw------- 49 w
User
To determine the file status for a particular user the option -u username is used. For example when used against user account 'joeuser':
%fstat -u joeuser USER CMD PID FD MOUNT INUM MODE SZ|DV R/W joeuser fstat 96741 root / 2 drwxr-xr-x 512 r joeuser fstat 96741 wd /usr 2378753 drwxr-xr-x 512 r joeuser fstat 96741 text /usr 2308260 -r-xr-sr-x 14340 r joeuser fstat 96741 0 /dev 93 crw--w---- ttyp0 rw joeuser fstat 96741 1 /dev 93 crw--w---- ttyp0 rw joeuser fstat 96741 2 /dev 93 crw--w---- ttyp0 rw joeuser fstat 96741 3 /dev 26 crw-r----- mem r joeuser fstat 96741 4 /dev 27 crw-r----- kmem r joeuser fstat 96741 5 / 25179 -rw-r--r-- 40960 r joeuser csh 760 root / 2 drwxr-xr-x 512 r joeuser csh 760 wd /usr 2378753 drwxr-xr-x 512 r joeuser csh 760 text / 16628 -r-xr-xr-x 293060 r joeuser csh 760 15 /dev 93 crw--w---- ttyp0 rw joeuser csh 760 16 /dev 93 crw--w---- ttyp0 rw joeuser csh 760 17 /dev 93 crw--w---- ttyp0 rw joeuser csh 760 18 /dev 93 crw--w---- ttyp0 rw joeuser csh 760 19 /dev 93 crw--w---- ttyp0 rw joeuser sshd 759 root / 2 drwxr-xr-x 512 r joeuser sshd 759 wd / 2 drwxr-xr-x 512 r joeuser sshd 759 text /usr 1318917 -r-xr-xr-x 180452 r joeuser sshd 759 0 /dev 6 crw-rw-rw- null rw joeuser sshd 759 1 /dev 6 crw-rw-rw- null rw joeuser sshd 759 2 /dev 6 crw-rw-rw- null rw joeuser sshd 759 3* internet stream tcp c23cf1d0 joeuser sshd 759 4* local stream c23b47a8 <-> c23b4c94 joeuser sshd 759 5* pipe c2335660 <-> c2335718 0 rw joeuser sshd 759 6* pipe c2335718 <-> c2335660 0 rw joeuser sshd 759 7 /dev 92 crw-rw-rw- ptyp0 rw joeuser sshd 759 8 /dev 92 crw-rw-rw- ptyp0 rw joeuser sshd 759 9 /dev 92 crw-rw-rw- ptyp0 rw
