Tag Info

Hot answers tagged

32

As long as you don't move the file across file-system borders, the operation should be safe. This is due to the mechanism, how »moving« actually is done. If you mv a file on the same file-system, the file isn't actually touched, but only the file-system entry is changed. $ mv foo bar actually does something like $ ln foo bar $ rm foo This would ...


22

The reason is that the operating system needs memory to manage each open file, and memory is a limited resource - especially on embedded systems. As root user you can change the maximum of the open files count per process (via ulimit -n) and per system (e.g. echo 800000 > /proc/sys/fs/file-max).


21

If you can't kill your application, you can truncate instead of deleting the log file to reclaim the space. If the file was not open in append mode (with O_APPEND), then the file will appear as big as before the next time the application writes to it (though with the leading part sparse and looking as if it contained NUL bytes), but the space will have been ...


20

You can stop both processing by sending them SIGSTOP (replace pid1 and pid2 by the actual PIDs or use killall and the application name): kill -SIGSTOP pid1 pid2 The printing on the terminal (or wherever stdout is redirected to) should stop. Then continue one of them using kill -SIGCONT pid1 If the error messages appear immediately, you know its the ...


19

You can do lsof -n | grep -i "TCP\|UDP" | grep -v "ESTABLISHED\|CLOSE_WAIT" to see all of your listening ports, but dollars to donuts that ntpd is running: service ntpd status And as for "What does socket in use" mean? If I can be forgiven for smoothing over some wrinkles (and for the very basic explanation, apologies of most of this is remedial for ...


19

A hard limit can only be raised by root (any process can lower it). So it is useful for security: a non-root process cannot overstep a hard limit. But it's inconvenient in that a non-root process can't have a lower limit than its children. A soft limit can be changed by the process at any time. So it's convenient as long as processes cooperate, but no good ...


18

Use lsof | grep /media/whatever to find out what is using the mount. Also, consider umount -l (lazy umount) to prevent new processes from using the drive while you clean up.


17

Programs connect to files through a number maintained by the filesystem (called an inode on traditional unix filesystems), to which the name is just a reference (and possibly not a unique reference at that). So several things to be aware of: Moving a file using mv does not change that underling number unless you move it across filesystems (which is ...


15

That's the inode number for the pipe or socket in question. A pipe is a unidirectional channel, with a write end and a read end. In your example, it looks like FD 5 and FD 6 are talking to each other, since the inode numbers are the same. (Maybe not, though. See below.) More common than seeing a program talking to itself over a pipe is a pair of separate ...


15

According to the author of lsof, it's impossible to find this out: the Linux kernel does not expose this information. Source: 2003 thread on comp.unix.admin. The number shown in /proc/$pid/fd/$fd is the socket's inode number in the virtual socket filesystem. When you create a pipe or socket pair, each end successively receives an inode number. The numbers ...


15

Running it with strace -e trace=open,close,read,write,connect,accept your-command-here would probably be sufficient. You'll need to use the -o option to put strace's output somewhere other than the console, if the process can print to stderr. If your process forks, you'll also need -f or -ff. Oh, and you might want -t as well, so you can see when the ...


14

The file descriptor, i.e. the 4 in your example, is the index into the process-specific file descriptor table, not the open file table. The file descriptor entry itself contains an index to an entry in the kernel's global open file table, as well as file descriptor flags.


14

tail +1f file I tested it on Ubuntu with the LibreOffice source tarball while wget was downloading it: tail +1f libreoffice-4.2.5.2.tar.xz | tar -tvJf - It also works on Solaris 10, RHEL3, AIX 5 and Busybox 1.22.1 in my Android phone (use tail +1 -f file with Busybox).


13

Each process has its own file descriptor table. File descriptor 4 in process 1234 points inside process 1234's table. File descriptor 4 in process 5678 points inside process 5678's table. A case you must be familiar with are file descriptors 0, 1 and 2 which for each process are the standard input, standard output and standard error, pointing wherever these ...


13

On linux, you can find the position of the file descriptor number N of process PID in /proc/$PID/fdinfo/$N. Example: $ cat /proc/687705/fdinfo/36 pos: 26088 flags: 0100001 The same file can be opened several times with different positions using several file descriptors, so you'll have to choose the relevant one in the case there are more than one. ...


13

On Linux, assuming you want to know what is writing to the same resource as your shell's stdout is connected to, you could do: strace -fe write $(lsof -t "/proc/$$/fd/1" | sed 's/^/-p/') That would report the write() system calls (on any file descriptor) of every process that have at least one file descriptor open on the same file as fd 1 of your shell.


11

Moving a file or directory changes the meta-data property that identifies its parent in the file tree, but it doesn't change its actual node id. On the physical disk it's still in the same place, and the filesystem still knows it as the same object. Anywhere the file or directory pointer is open, it is already connected to that object, and a change to the ...


11

Check out the fildescriptor #1 (stdout) in /proc/$PID/fd/. The kernel represents this file as symbolic link to a file the descriptor is redirected to. $ readlink -f /proc/20361/fd/1 /tmp/file


11

For sockets you can find more information about the inode in /proc/net/tcp, /proc/net/udp or /proc/net/unix. For example: ls -l /proc/<pid>/fd lrwx------ 1 root root 64 May 26 22:03 3 -> socket:[53710569] We see inode is 53710569. head -n1 < tcp ; grep -a 53710569 tcp sl local_address rem_address st tx_queue rx_queue tr tm->when ...


11

Making /dev/null a named pipe is probably the easiest way. Be warned that some programs (sshd, for example) will act abnormally or fail to execute when they find out that it isn't a special file (or they may read from /dev/null, expecting it to return EOF). # Remove special file, create FIFO and read from it rm /dev/null && mkfifo -m622 /dev/null ...


10

Well on Linux you could use inotify to track changes to your files. Inotify is in-kernel and has bindings to many different languages allowing you to quickly script such functionality if the app you are working with does not support inotify yet.


10

Most of the time, the best command to use is lsof (“list open files”). lsof +f -- /media/usb0 where /media/usb0 is the mount point of the USB drive or other filesystem to unmount. +f -- tells lsof to treat the subsequent argument as a mount point; it usually, but not always, manages on its own, so that lsof /media/usb0 also works. This finds open files ...


10

The inodes still persist on disk, although no more hard links to the inodes exist. They will be deleted when the file descriptor is closed. Until then, the file can be modified as normal, barring operations that require a filename/hard link. debugfs and similar tools can be used to recover the contents of the inodes.


10

The problem is that cat is not aware that the file is still being appended. As soon as cat encounters the (current) end of the file it exits. You have to make wget write to a pipe (or FIFO) in order to avoid this. wget -O - http://... | tar -xjf -


9

The best test to see if a server is accepting connections is to actually try connecting. Use a regular client for whatever protocol your server speaks and try a no-op command. If you want a lightweight TCP or UDP client you can drive simply from the shell, use netcat. How to program a conversation depends on the protocol; many protocols have the server ...


9

You can also use netstat to look for open sockets--it's much cleaner than using lsof as the other posters have suggested. Try this command line as root netstat -lp -u -t to view all listening connections, including their associated pid's and programs. The -l parameter is what specifies listening connections, -p specifies that you want to see the PID/name ...


9

Erkki Seppala actually has a tool that retrieves this information from the Linux kernel with gdb.. It's available here.


9

The Unix Rosetta Stone is a good resource for this kind of questions. It mentions a few alternatives for lsof (see below). Do not however that lsof is the de facto standard application for what it does. If all you want is to find the process ID(s) that have a particular file open, then you can use fuser on any POSIX-compliant system. On operating systems ...


9

The file descriptor 1 translates to the stdout FILE structure in the Kernel's Open Files Table. This is a misunderstanding. The kernel's file table has nothing whatsoever to do with user-space file structures. In any event, the kernel has two levels of indirection. There is the internal structure that represents the file itself, which is reference ...


8

There is not really a more specific term. In traditional Unix, file descriptors reference entries in the file table, entries of which are referred to as files, or sometimes open files. This is in a specific context, so while obviously the term file is quite generic, in the context of the file table it specifically refers to open files. Files on disk are ...



Only top voted, non community-wiki answers of a minimum length are eligible