Very Computer

A while back someone was looking for a tool to find what  
files were open on a device.

The answer came back: lsof seemed to be the recommended  
choice.

However lsof doesn't handle nfs files.  e.g.  I'm on a  
server; suddenly the disk goes snake.  I want to know what  
process is doing this.

Or;
        I'd like to unmount a partition.  I get a "device  
busy"  How do I find out who has a cwd on that partition?

csh       11873   vanepp  cwd    DIR    18,   5       6656  84022 /staff2 (catacomb-e2.sfu.ca:/staff2)

This is one line (that happens to be my home directory) from the lsof2B (beta)
version running on a Silicon Graphics machine. /staff2 is NFS mounted from
our Auspex file server. It is possible the non beta lsof doesn't find this
(but then it didn't run on the SGI's either). The same thing works on a Sun.
fuser is another way to find the same thing on the SGI, but it doesn't seem
to work on the Sun.

On the same SGI as above.

fuser catacomb-e2.sfu.ca:/staff2

catacomb-e2.sfu.ca:/staff2:    11873c   12960c   12960   12744c    5098c    5098   12516c   11946c   11946   25274c   12749c   12959c

Peter Van Epp / Operations and Technical Support
Simon Fraser University, Burnaby, B.C. Canada

Quote:>However lsof doesn't handle nfs files.  e.g.  I'm on a  
>server; suddenly the disk goes snake.  I want to know what  
>process is doing this.

Sorry, but the NFS protocol doesn't provide the information for a server to
know which client process is performing each access; there's no processid
in NFS requests.  And kernel-based, stateless NFS servers don't open files,
they just access the files directly for each request (the NFS file handle
includes device and inode information).

When this happens here we use the PD tools nfswatch and/or tcpdump to find
the client machine that's hammering the server.  I then use tcpdump to get
a hex dump of the NFS packets from that client and find the userid.  Then I
use ps on the client machine to look for active processes of that user.

If the author of nfswatch is reading this, I suggest that it provide a mode

--
Barry Margolin
System Manager, Thinking Machines Corp.

JRandomUser is working on badgar.  His home directory is  
/home/jru.

If I'm on aardvark, and type
lsof /dev/sd1a
I only get entries for processes running on aardvark.

If I explicitly ask for NFS files
lsof -N
I get all the NFS files that aardvark has open from other  
servers.

Quote:

> This is one line (that happens to be my home directory)  

Quote:> version running on a Silicon Graphics machine. /staff2 is  
NFS mounted from
> our Auspex file server. It is possible the non beta lsof  
doesn't find this
> (but then it didn't run on the SGI's either). The same  

Quote:> fuser is another way to find the same thing on the SGI,  
but it doesn't seem
> to work on the Sun.

> On the same SGI as above.

> fuser catacomb-e2.sfu.ca:/staff2

> catacomb-e2.sfu.ca:/staff2:    11873c   12960c   12960    

Quote:

> Peter Van Epp / Operations and Technical Support
> Simon Fraser University, Burnaby, B.C. Canada