2019-03-30 23:40:26 -07:00
|
|
|
.\" $OpenBSD: fstat.1,v 1.59 2019/03/31 06:40:26 jmc Exp $
|
2000-03-07 13:11:07 -08:00
|
|
|
.\"
|
1995-10-18 01:37:01 -07:00
|
|
|
.\" Copyright (c) 1987, 1991, 1993
|
|
|
|
.\" The Regents of the University of California. All rights reserved.
|
|
|
|
.\"
|
|
|
|
.\" Redistribution and use in source and binary forms, with or without
|
|
|
|
.\" modification, are permitted provided that the following conditions
|
|
|
|
.\" are met:
|
|
|
|
.\" 1. Redistributions of source code must retain the above copyright
|
|
|
|
.\" notice, this list of conditions and the following disclaimer.
|
|
|
|
.\" 2. Redistributions in binary form must reproduce the above copyright
|
|
|
|
.\" notice, this list of conditions and the following disclaimer in the
|
|
|
|
.\" documentation and/or other materials provided with the distribution.
|
2003-06-02 19:56:05 -07:00
|
|
|
.\" 3. Neither the name of the University nor the names of its contributors
|
1995-10-18 01:37:01 -07:00
|
|
|
.\" may be used to endorse or promote products derived from this software
|
|
|
|
.\" without specific prior written permission.
|
|
|
|
.\"
|
|
|
|
.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
|
|
|
|
.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
|
|
.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
|
|
|
.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
|
|
|
|
.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
|
|
|
.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
|
|
|
.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
|
|
|
.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
|
|
|
.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
|
|
|
.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
|
|
|
.\" SUCH DAMAGE.
|
|
|
|
.\"
|
|
|
|
.\" from: @(#)fstat.1 8.3 (Berkeley) 2/25/94
|
|
|
|
.\"
|
2019-03-30 18:08:09 -07:00
|
|
|
.Dd $Mdocdate: March 31 2019 $
|
1995-10-18 01:37:01 -07:00
|
|
|
.Dt FSTAT 1
|
1999-06-04 18:21:16 -07:00
|
|
|
.Os
|
1995-10-18 01:37:01 -07:00
|
|
|
.Sh NAME
|
|
|
|
.Nm fstat
|
2000-01-18 23:38:25 -08:00
|
|
|
.Nd display status of open files
|
1995-10-18 01:37:01 -07:00
|
|
|
.Sh SYNOPSIS
|
|
|
|
.Nm fstat
|
2006-03-26 09:55:31 -08:00
|
|
|
.Op Fl fnosv
|
1995-10-18 01:37:01 -07:00
|
|
|
.Op Fl M Ar core
|
|
|
|
.Op Fl N Ar system
|
|
|
|
.Op Fl p Ar pid
|
|
|
|
.Op Fl u Ar user
|
2009-07-08 09:04:00 -07:00
|
|
|
.Op Ar
|
1995-10-18 01:37:01 -07:00
|
|
|
.Sh DESCRIPTION
|
2000-11-09 21:10:21 -08:00
|
|
|
.Nm
|
1995-10-18 01:37:01 -07:00
|
|
|
identifies open files.
|
|
|
|
A file is considered open by a process if it was explicitly opened,
|
2009-07-19 05:56:19 -07:00
|
|
|
is the working directory, root directory, active executable text, or kernel
|
1995-10-18 01:37:01 -07:00
|
|
|
trace file for that process.
|
|
|
|
If no options are specified,
|
2000-11-09 21:10:21 -08:00
|
|
|
.Nm
|
1995-10-18 01:37:01 -07:00
|
|
|
reports on all open files in the system.
|
|
|
|
.Pp
|
1999-10-17 13:24:33 -07:00
|
|
|
The options are as follows:
|
1995-10-18 01:37:01 -07:00
|
|
|
.Bl -tag -width Ds
|
|
|
|
.It Fl f
|
2000-03-07 13:11:07 -08:00
|
|
|
Restrict examination to files open in the same file systems as
|
|
|
|
the named file arguments, or to the file system containing the
|
1995-10-18 01:37:01 -07:00
|
|
|
current directory if there are no additional filename arguments.
|
2000-03-07 13:11:07 -08:00
|
|
|
For example, to find all files open in the file system where the
|
1995-10-18 01:37:01 -07:00
|
|
|
directory
|
|
|
|
.Pa /usr/src
|
|
|
|
resides, type
|
2004-01-21 11:25:33 -08:00
|
|
|
.Pp
|
2004-07-13 16:36:56 -07:00
|
|
|
.Dl # fstat -f /usr/src
|
1999-07-20 18:25:42 -07:00
|
|
|
.It Fl M Ar core
|
1995-10-18 01:37:01 -07:00
|
|
|
Extract values associated with the name list from the specified core
|
2001-11-08 16:56:21 -08:00
|
|
|
instead of the running kernel.
|
1999-07-20 18:25:42 -07:00
|
|
|
.It Fl N Ar system
|
2001-11-08 16:56:21 -08:00
|
|
|
Extract the name list from the specified system instead of the running kernel.
|
1995-10-18 01:37:01 -07:00
|
|
|
.It Fl n
|
2000-03-07 13:11:07 -08:00
|
|
|
Numerical format.
|
|
|
|
Print the device number (maj,min) of the file system
|
2000-03-23 13:10:09 -08:00
|
|
|
the file resides in rather than the mount point name.
|
|
|
|
For special files, print the
|
1995-10-18 01:37:01 -07:00
|
|
|
device number that the special device refers to rather than the filename
|
|
|
|
in
|
2000-03-07 13:11:07 -08:00
|
|
|
.Pa /dev .
|
|
|
|
Also, print the mode of the file in octal instead of symbolic form.
|
2000-07-16 16:40:48 -07:00
|
|
|
.It Fl o
|
|
|
|
Output file offset.
|
|
|
|
Follow the size field with the descriptor's offset.
|
|
|
|
Useful for checking progress as a process works through a large file.
|
2008-10-06 19:20:11 -07:00
|
|
|
This information is only visible to the user or superuser.
|
2000-11-09 21:10:21 -08:00
|
|
|
.It Fl p Ar pid
|
1995-10-18 01:37:01 -07:00
|
|
|
Report all files open by the specified process.
|
2019-01-29 23:56:11 -08:00
|
|
|
This option may be specified multiple times.
|
2006-03-26 09:55:31 -08:00
|
|
|
.It Fl s
|
|
|
|
Report per file io statistics in two additional columns
|
|
|
|
.Sq XFERS
|
|
|
|
and
|
|
|
|
.Sq KBYTES .
|
2008-10-06 19:20:11 -07:00
|
|
|
This information is only visible to the user or superuser.
|
2000-11-09 21:10:21 -08:00
|
|
|
.It Fl u Ar user
|
1995-10-18 01:37:01 -07:00
|
|
|
Report all files open by the specified user.
|
2019-01-29 23:56:11 -08:00
|
|
|
This option may be specified multiple times.
|
1995-10-18 01:37:01 -07:00
|
|
|
.It Fl v
|
2000-03-07 13:11:07 -08:00
|
|
|
Verbose mode.
|
|
|
|
Print error messages upon failures to locate particular
|
|
|
|
system data structures rather than silently ignoring them.
|
|
|
|
Most of these data structures are dynamically created or deleted and it is
|
1995-10-18 01:37:01 -07:00
|
|
|
possible for them to disappear while
|
2000-11-09 21:10:21 -08:00
|
|
|
.Nm
|
2000-03-07 13:11:07 -08:00
|
|
|
is running.
|
2000-03-23 13:10:09 -08:00
|
|
|
This is normal and unavoidable since the rest of the system is running while
|
2000-11-09 21:10:21 -08:00
|
|
|
.Nm
|
1995-10-18 01:37:01 -07:00
|
|
|
itself is running.
|
2009-08-16 02:41:07 -07:00
|
|
|
.It Ar
|
1995-10-18 01:37:01 -07:00
|
|
|
Restrict reports to the specified files.
|
|
|
|
.El
|
|
|
|
.Pp
|
|
|
|
The following fields are printed:
|
|
|
|
.Bl -tag -width MOUNT
|
|
|
|
.It Li USER
|
1998-09-26 12:54:41 -07:00
|
|
|
The username of the owner of the process (effective UID).
|
1995-10-18 01:37:01 -07:00
|
|
|
.It Li CMD
|
|
|
|
The command name of the process.
|
|
|
|
.It Li PID
|
1998-09-26 12:54:41 -07:00
|
|
|
The process ID.
|
1995-10-18 01:37:01 -07:00
|
|
|
.It Li FD
|
|
|
|
The file number in the per-process open file table or one of the following
|
|
|
|
special names:
|
2019-03-30 18:08:09 -07:00
|
|
|
.Pp
|
2019-03-30 23:40:26 -07:00
|
|
|
.Bl -tag -width "text" -offset indent -compact
|
2019-03-30 18:08:09 -07:00
|
|
|
.It text
|
|
|
|
executable text inode
|
|
|
|
.It wd
|
|
|
|
current working directory
|
|
|
|
.It root
|
|
|
|
root inode
|
|
|
|
.It tr
|
|
|
|
kernel trace file
|
|
|
|
.El
|
1995-10-18 01:37:01 -07:00
|
|
|
.Pp
|
2000-03-07 13:11:07 -08:00
|
|
|
If the file number is followed by an asterisk
|
|
|
|
.Pq Ql * ,
|
2005-12-15 04:15:45 -08:00
|
|
|
the file is not an inode, but rather a socket, or there is an error.
|
1995-10-18 01:37:01 -07:00
|
|
|
In this case the remainder of the line doesn't
|
2018-03-16 09:58:26 -07:00
|
|
|
correspond to the remaining headers \(em the format of the line
|
1995-10-18 01:37:01 -07:00
|
|
|
is described later under
|
2003-09-05 06:38:46 -07:00
|
|
|
.Sx SOCKETS .
|
1995-10-18 01:37:01 -07:00
|
|
|
.It Li MOUNT
|
|
|
|
If the
|
|
|
|
.Fl n
|
|
|
|
flag wasn't specified, this header is present and is the
|
2000-03-07 13:11:07 -08:00
|
|
|
pathname that the file system the file resides in is mounted on.
|
1995-10-18 01:37:01 -07:00
|
|
|
.It Li DEV
|
|
|
|
If the
|
|
|
|
.Fl n
|
|
|
|
flag is specified, this header is present and is the
|
|
|
|
major/minor number of the device that this file resides in.
|
|
|
|
.It Li INUM
|
|
|
|
The inode number of the file.
|
2016-10-02 16:16:08 -07:00
|
|
|
It will be followed by an asterisk
|
|
|
|
.Pq Ql *
|
|
|
|
if the inode is unlinked from disk.
|
1995-10-18 01:37:01 -07:00
|
|
|
.It Li MODE
|
2000-03-23 13:10:09 -08:00
|
|
|
The mode of the file.
|
|
|
|
If the
|
1995-10-18 01:37:01 -07:00
|
|
|
.Fl n
|
|
|
|
flag isn't specified, the mode is printed
|
|
|
|
using a symbolic format (see
|
|
|
|
.Xr strmode 3 ) ;
|
|
|
|
otherwise, the mode is printed
|
|
|
|
as an octal number.
|
2007-10-01 15:06:02 -07:00
|
|
|
.It Li R/W
|
2017-01-21 04:21:56 -08:00
|
|
|
This column describes the properties of the file descriptor:
|
2019-03-30 18:08:09 -07:00
|
|
|
.Pp
|
|
|
|
.Bl -tag -width indent -compact
|
|
|
|
.It r
|
|
|
|
Open for reading
|
|
|
|
.It w
|
|
|
|
Open for writing
|
|
|
|
.It e
|
|
|
|
close-on-exec flag is set
|
|
|
|
.It p
|
|
|
|
Opened after
|
|
|
|
.Xr pledge 2
|
|
|
|
.El
|
2017-01-21 04:21:56 -08:00
|
|
|
.Pp
|
2007-10-01 15:06:02 -07:00
|
|
|
This field is useful when trying to find the processes that are
|
|
|
|
preventing a file system from being downgraded to read-only.
|
2011-05-02 04:14:11 -07:00
|
|
|
.It Li SZ | DV
|
1998-09-26 12:54:41 -07:00
|
|
|
If the file is not a character or block special file, prints the size of
|
2000-03-07 13:11:07 -08:00
|
|
|
the file in bytes.
|
|
|
|
Otherwise, if the
|
1995-10-18 01:37:01 -07:00
|
|
|
.Fl n
|
|
|
|
flag is not specified, prints
|
|
|
|
the name of the special file as located in
|
|
|
|
.Pa /dev .
|
2000-03-07 13:11:07 -08:00
|
|
|
If that cannot be located, or the
|
1995-10-18 01:37:01 -07:00
|
|
|
.Fl n
|
|
|
|
flag is specified, prints the major/minor device
|
|
|
|
number that the special device refers to.
|
|
|
|
.It Li NAME
|
|
|
|
If filename arguments are specified and the
|
|
|
|
.Fl f
|
|
|
|
flag is not, then
|
|
|
|
this field is present and is the name associated with the given file.
|
|
|
|
Normally the name cannot be determined since there is no mapping
|
|
|
|
from an open file back to the directory entry that was used to open
|
2000-03-07 13:11:07 -08:00
|
|
|
that file.
|
|
|
|
Also, since different directory entries may reference
|
1995-10-18 01:37:01 -07:00
|
|
|
the same file (via
|
2003-03-10 07:37:29 -08:00
|
|
|
.Xr ln 1 ) ,
|
1995-10-18 01:37:01 -07:00
|
|
|
the name printed may not be the actual
|
|
|
|
name that the process originally used to open that file.
|
2006-03-26 09:55:31 -08:00
|
|
|
.It Li XFERS
|
2011-10-02 14:46:29 -07:00
|
|
|
Displays number of total data transfers performed on the file.
|
2006-03-26 09:55:31 -08:00
|
|
|
.It Li KBYTES
|
|
|
|
Displays total number of Kbytes written and read to the file.
|
1995-10-18 01:37:01 -07:00
|
|
|
.El
|
|
|
|
.Sh SOCKETS
|
1999-09-22 21:11:58 -07:00
|
|
|
The formatting of open sockets depends on the protocol domain.
|
2008-12-15 01:49:59 -08:00
|
|
|
In all cases the first field is the domain name
|
|
|
|
and the second field is the socket type (stream, dgram, etc).
|
1995-10-18 01:37:01 -07:00
|
|
|
The remaining fields are protocol dependent.
|
1998-09-26 12:54:41 -07:00
|
|
|
For TCP, it is the address of the tcpcb, and for UDP, the inpcb (socket pcb).
|
2009-10-22 05:35:53 -07:00
|
|
|
For
|
2009-10-22 08:02:12 -07:00
|
|
|
.Ux Ns -domain
|
|
|
|
sockets, it's the address of the socket pcb and the address
|
1995-10-18 01:37:01 -07:00
|
|
|
of the connected pcb (if connected).
|
|
|
|
Otherwise the protocol number and address of the socket itself are printed.
|
1999-06-04 18:21:16 -07:00
|
|
|
The attempt is to make enough information available to
|
1995-10-18 01:37:01 -07:00
|
|
|
permit further analysis without duplicating
|
|
|
|
.Xr netstat 1 .
|
|
|
|
.Pp
|
|
|
|
For example, the addresses mentioned above are the addresses which the
|
2000-03-07 13:11:07 -08:00
|
|
|
.Ic netstat -A
|
2009-10-22 05:35:53 -07:00
|
|
|
command would print for TCP, UDP, and
|
2009-10-22 08:02:12 -07:00
|
|
|
.Ux Ns -domain.
|
2017-05-10 02:09:45 -07:00
|
|
|
These addresses are only visible to the superuser, otherwise 0x0 is printed.
|
|
|
|
Sockets that have been disassociated from a protocol control block
|
|
|
|
will always print 0x0.
|
2009-10-22 05:35:53 -07:00
|
|
|
A unidirectional
|
2009-10-22 08:02:12 -07:00
|
|
|
.Ux Ns -domain
|
|
|
|
socket indicates the direction of flow with
|
2000-03-07 13:11:07 -08:00
|
|
|
an arrow
|
|
|
|
.Pf ( Dq <-
|
|
|
|
or
|
|
|
|
.Dq -> ) ,
|
|
|
|
and a full duplex socket shows a double arrow
|
2003-07-14 01:56:02 -07:00
|
|
|
.Pq Dq <-> .
|
1996-08-17 02:12:27 -07:00
|
|
|
.Pp
|
2000-11-09 21:10:21 -08:00
|
|
|
For
|
|
|
|
.Dv AF_INET
|
2012-01-06 21:38:12 -08:00
|
|
|
and
|
|
|
|
.Dv AF_INET6
|
2000-11-09 21:10:21 -08:00
|
|
|
sockets,
|
|
|
|
.Nm
|
1996-08-17 02:12:27 -07:00
|
|
|
also attempts to print the internet address and port for the
|
|
|
|
local end of a connection.
|
|
|
|
If the socket is connected, it also prints the remote internet address
|
|
|
|
and port.
|
2000-03-07 13:11:07 -08:00
|
|
|
A
|
|
|
|
.Ql *
|
|
|
|
is used to indicate an
|
|
|
|
.Dv INADDR_ANY
|
|
|
|
binding.
|
|
|
|
In this case, the
|
|
|
|
use of the arrow
|
|
|
|
.Pf ( Dq <--
|
|
|
|
or
|
|
|
|
.Dq --> )
|
|
|
|
indicates the direction the socket connection was created.
|
2012-01-06 21:38:12 -08:00
|
|
|
.Pp
|
2015-01-31 11:33:45 -08:00
|
|
|
If the socket has been spliced to or from another socket (see
|
2012-01-06 21:38:12 -08:00
|
|
|
.Xr setsockopt 2
|
|
|
|
and
|
2012-01-07 00:30:37 -08:00
|
|
|
.Dv SO_SPLICE )
|
|
|
|
then
|
2012-01-06 21:38:12 -08:00
|
|
|
.Nm
|
|
|
|
prints a thick arrow
|
|
|
|
.Pf ( Dq <==> ,
|
|
|
|
.Dq <== ,
|
|
|
|
or
|
|
|
|
.Dq ==> ) ,
|
|
|
|
followed by the address and endpoint information of the other socket
|
|
|
|
in the splice,
|
|
|
|
if available.
|
1998-09-06 18:04:13 -07:00
|
|
|
.Sh PIPES
|
|
|
|
Every pipe is printed as an address which is the same for both sides of
|
2000-03-07 13:11:07 -08:00
|
|
|
the pipe and a state that is built of the letters
|
|
|
|
.Dq RWE .
|
2003-07-14 01:56:02 -07:00
|
|
|
W \- The pipe blocks waiting for the reader to read data.
|
|
|
|
R \- The pipe blocks waiting for the writer to write data.
|
|
|
|
E \- The pipe is in EOF state.
|
2002-05-18 10:54:15 -07:00
|
|
|
.Sh KQUEUE
|
2002-05-20 14:19:21 -07:00
|
|
|
Each
|
|
|
|
.Xr kqueue 2
|
|
|
|
is printed with some information as to queue length.
|
2002-09-30 02:54:56 -07:00
|
|
|
Since these things are normally serviced quickly, it is likely that
|
2002-05-18 10:54:15 -07:00
|
|
|
nothing of real importance can be discerned.
|
1995-10-18 01:37:01 -07:00
|
|
|
.Sh SEE ALSO
|
|
|
|
.Xr netstat 1 ,
|
|
|
|
.Xr nfsstat 1 ,
|
|
|
|
.Xr ps 1 ,
|
|
|
|
.Xr systat 1 ,
|
2005-09-06 16:28:23 -07:00
|
|
|
.Xr top 1 ,
|
1995-10-18 01:37:01 -07:00
|
|
|
.Xr iostat 8 ,
|
|
|
|
.Xr pstat 8 ,
|
2004-07-13 16:33:28 -07:00
|
|
|
.Xr tcpdrop 8 ,
|
1995-10-18 01:37:01 -07:00
|
|
|
.Xr vmstat 8
|
|
|
|
.Sh HISTORY
|
|
|
|
The
|
|
|
|
.Nm
|
|
|
|
command appeared in
|
|
|
|
.Bx 4.3 tahoe .
|
2004-05-08 23:17:15 -07:00
|
|
|
.Sh CAVEATS
|
|
|
|
Sockets in use by the kernel, such as those opened by
|
|
|
|
.Xr nfsd 8 ,
|
|
|
|
will not be seen by
|
|
|
|
.Nm ,
|
|
|
|
even though they appear in
|
|
|
|
.Xr netstat 1 .
|
2000-11-09 21:10:21 -08:00
|
|
|
.Sh BUGS
|
|
|
|
Since
|
|
|
|
.Nm
|
|
|
|
takes a snapshot of the system, it is only correct for a very short period
|
|
|
|
of time.
|
|
|
|
.Pp
|
|
|
|
Moreover, because DNS resolution and YP lookups cause many file
|
|
|
|
descriptor changes,
|
|
|
|
.Nm
|
|
|
|
does not attempt to translate the internet address and port numbers into
|
|
|
|
symbolic names.
|