File opened by the query process [go]

Fuser

Sometimes I want to know how many files my program has opened during this launch, and I can use fuser to watch it! For example, if you find the system notification when uninstalling: "Device is busy", that means that the file system is busy, indicating that there is a program to use the file system! Then you can use Fuser to track lo! Fuser syntax is a bit like this:

[Email protected] ~]# fuser [-UMV] [-K [i] [-signal]] file/dir options and parameters:-U  : In addition to the PID of the program, the owner of the program is also listed;-M  : The file name next to it will take the initiative to mention the top of the filesystem, the Umount is not successful very effective!  -V: You can list the full relevance of each file to the program and the command!  -K: Find the PID using the file/directory, and try to give the pid;-i with the SIGKILL signal  : Must be in conjunction with-K, before removing the PID will ask the user will! -signal: For example-1-15 and so on, if not added, the default is SIGKILL (-9) Luo! Example one: Find out where the current directory is using Pid/account/permissions? [Email protected] ~]# FUSER-UV.                     USER        PID ACCESS COMMAND.:                   root      20639. C.. (root) Bash

Did you see the results of the output? He said, "." At the bottom there is a program with a PID of 20639, which is root and the command is bash. What's interesting is the ACCESS project, which represents the meaning of the project:

• C: This program is in the current directory (not the secondary directory);
• E: Can be triggered as a running state;
• F: is a file that is opened;
• R: Represents the top level directory (root directory);
• F: The file is open, but waiting for a response;
• M: A dynamic function library that may be shared;

So if you want to see how many programs under a file system are occupying the filesystem, the-m option is helpful! Brother Bird's Test host has only split out/,/boot,/home, so it cannot be tested. But fortunately there is also a/proc virtual file system, let us see how many programs this/proc file system is using him!

Example two: Find all the programs used to/proc this file system! [[email protected] ~]# fuser-uv/proc# will not show any data, because no program will go to use/proc this directory Ah! # will be used in the file under the/proc! So you should do this: [[email protected] ~]# fuser-mvu/proc                     USER        PID ACCESS command/proc:               root       4289 f .... (root) klogd                     root       4555 f .... (root) acpid                     Haldaemon  4758 f .... (Haldaemon) Hald                     root       4977 F .... (Root) xorg# have these programs in the/proc file system access Oh! Is that clear?

Now that you can target the entire file system, is it possible to target only a single file? Of course you can! Take a look at the following case first:

Example three: Find the file under/var that belongs to the FIFO type and find the program that accesses the file [[email protected] ~]# Find/var-type P/var/gdm/.gdmfifo     <== We're on this thing! /var/run/autofs.fifo-misc/var/run/autofs.fifo-net[[email protected] ~]# fuser-uv/var/gdm/.gdmfifo                     USER        PID ACCESS command/var/gdm/.gdmfifo:   root       4892 F .... (root) gdm-binary example four: same example three, but trying to remove the PID? and "Do not" delete Oh! [[email protected] ~]# Fuser-ki/var/gdm/.gdmfifo/var/gdm/.gdmfifo:    4892Kill process 4892? (y/n) N

How is it? It's an interesting order! Through this fuser we can find out the use of the file, the directory of the program, to observe! His focus is different from PS, Pstree. Fuser lets us know what programs are currently being used by a file (or file system)!

lsof

In contrast to the fuser is a file or device to find the use of the file or device program, on the other hand, how to find out a program to open or use the files and devices? Whirring That is to use lsof Luo ~

[[email protected] ~]# lsof [-auu] [+d] options and Parameters:-A: Multiple data needs to "set up at the same time" to show the results! -U: Lists only the socket file types of the Unix like system;-u: followed by username, which lists the files opened by the user-related program; +d: Follow the directory, that is, find the file that has been opened under a directory!      Example one: List all the files and devices that are currently open on the system: [[[email protected] ~]# lsofcommand PID USER FD TYPE device SIZE NODE nameinit 1 root cwd dir 3,2 4096 2/init 1 root rtd dir 3,2 4096 2/init 1 root TX T REG 3,2 38620 1426405/sbin/init .... (omitted at the bottom) .... # Did you notice? Yes, in the default case, Lsof will be the current system above the open # file all listed ~ So, the screen is more scary Ah! You can notice that the first file init runs the # Place right in the root directory, and the root directory, hehe! The inode also shows up!  Example two: Only the socket file opened for all programs rooted in root [[email protected] ~]# lsof-u root-a-ucommand PID USER FD TYPE DEVICE         SIZE NODE nameudevd root 3u unix 0xedd4cd40 1445 socketauditd 4256 root 7u Unix 0xedd4c380 9081 socketaudispd 4258 root 0u unix 0xedd4c1e0 9080 socket# Notice that-a bar! If you enter Lsof-u root and lsof-u separately, what information will you have? # Use Lsof-u root-u and lsof-u roOt-a-U, hehe! It's different! #-A's purpose is to solve the need for two of projects at the same time Ah!  ^_^ Example Three: Please list all the devices that are currently activated on the system [[email protected] ~]# lsof +d/devcommand PID USER FD TYPE device SIZE        NODE nameinit 1 root 10u FIFO 0,16 1147/dev/initctludevd root 0u CHR     1,3 1420/DEV/NULLUDEVD root 1u CHR 1,3 1420/dev/nulludevd 2u CHR 1,3 1420/dev/null# look at it! Because the device is in/dev! So Luo, use the search directory can ah! Example four: Show root bash The file opened by this program [[email protected] ~]# lsof-u root |         grep bashbash 20639 root cwd dir 3,2 4096 648321/rootbash 20639 root rtd dir 3,2 4096 2/bash 20639 root txt reg 3,2 735004 1199424/bin/bashbash 20639 root mem REG 3,2 46680 64873 /lib/libnss_files-2.5.so .... (omitted below) ....

This command can find out if you want to know if a program has activated what information? For example, the above mentioned example four of the results of the operation!

Transfer from http://vbird.dic.ksu.edu.tw/linux_basic/0440processcontrol_4.php

File opened by the query process [go]