Files used by a process 1

[icecubegr]

This is the first time I write here, so "Hi everybody" and thanks in advance for your answers (I hope I get some hahaha)

I have a performance issue on a program based on hashed files and I am pretty sure that the reason is that some files are badly resized (very important for hash files). The problem is that this program is like a black box with around 4000 files and I do not know the file accessed at a moment by a specific process.

Is there any way to get that from the system?

If I cannot do it from system level I guess I have to write a program. Note that all files are placed in many directories placed to a parent directory (its like a tree), so maybe I can scan recursuvely the main directory and check access time for each one of the files placed in them.

Thanks again and sorry for my pure english ))))
George

 

[KenCunningham]

lsof might provide what you need.

 

[khalidaaa]

Try this on command line:

truss -F -o output.txt program

program: is your program to be tested.

output.txt: is the trace file for your program

then view the content of the output.txt and look for fopen lines to see the files that has been opened using the program.

I hope this will help. Please feel free to ask any thing about the above.

Regards,
Khalid

 

[icecubegr]

First of all thanks for your quick answer.

I tried to find 'lsof' but no success
=== Como start ==================
# man lsof
Manual entry for lsof not found or not installed.
# lsof
ksh: lsof: not found.
# type ls
ls is a tracked alias for /usr/bin/ls
# cd /usr/bin
# ls *ls*
alstat lsallqdev lskbd lsrpnode lssrc
canonls lsaudrec lsl lsrsrc lssrtbl
dspmqfls lsauthent lslicense lsrsrc-api lssrtbl-api
endmqlsr lsclcfg lslpp lsrsrcdef lssrtbldef
false lscmdargdef lsmksysb lsrsrcdef-api lssrtbldef-api
itelstdm lscomg lsnlspath lssavevg ntblstatus
itelstix lscondition lsque lssec runmqlsr
ls lscondresp lsquedev lssensor
lsactdef lsdisp lsresponse lssr
lsallq lsfont lsrpdomain lssr-api
=== Como end ==================

 

[khalidaaa]

you have to install the lsof from the Linux toolbox first!

try this instead of the above coz this will give you clearer output:

# truss -t open -o /tmp/truss.test Program > /dev/null
# more /tmp/truss.test

regards,
Khalid

 

[icecubegr]

'truss' is working. I just have to use '-p' flag (instead of a program name) to trace a process...

but I want to see the files used (read/write) at a moment even if they were opened in the past. The problem is that a job may take long time and I have to investigate why. Maybe that job runs for more than 1 hour, and the files were opened just once in the start of the program attahced with that process, so no 'open' statements.

For example I run it as:
truss -t open,kread,kwrite -o truss.out -p 49582

The first page of the output was:
kread(0, "\0", 1) (sleeping...)
kread(0, "1B", 1) = 1
kread(0, " [", 1) = 1
kread(0, " A", 1) = 1
kwrite(1, 0xF01BFC68, 1) = 1
kwrite(1, 0xF01BFC68, 45) = 45
kread(0, "\r", 1) = 1
kwrite(1, 0xF01BFC68, 7) = 7
kread(11, "\0\0\0\0\0\0\0\0\0\0\0\0".., 4096) = 4096
kwrite(11, "\0\0\0\0\0\0\0\0\0\0\0\0".., 3461) = 3461
kread(8, "\0\0\0\0\00E @\0\0\0\001".., 4096) = 4096
kread(8, "\0\0\0\0\0\0\0\0\0\0\0\0".., 4096) = 4096
kwrite(1, 0xF01BFC68, 17) = 17
kread(8, "\0\0\0\0\0\f10\0\0\0\002".., 4096) = 4096
kread(8, "\0\0\0\0\017 0\0\0\0\001".., 4096) = 4096
kread(8, "\0\0\0\0\0\0\0\0\0\0\0\0".., 4096) = 4096
kread(12, " J B C _ _ S O B X M L".., 512) = 37
kread(12, " J B C _ _ S O B X M L".., 152) = 37
kread(12, " J B C _ _ S O B X M L".., 120) = 37
kread(8, "\0\0\0\0\010 p\0\0\0\002".., 4096) = 4096
kread(8, "\0\0\0\0\015 ð\0\0\0\001".., 4096) = 4096
kread(8, "\0\0\0\0\0\0\0\0\0\0\0\0".., 4096) = 4096
kread(15, " J B C _ _ S O B X M L".., 512) = 37

As you can see there are read/write to files (the first parameter must be the file handler) that are already open. Can I somehow trace what are those files?

 

[khalidaaa]

hmmm

As you said the first parameter is the file handler which has been assigned by the open function. I don't really tried to locate the file by this parameter as i was using this command at first when i run a program. Can you run the truss when first running this program?

otherwise, you better install lsof and use the process id as you've done above.

you can find the lsof in the Linux ToolBox CD

Regards,
Khalid

 

[icecubegr]

My friend the processes run on an IBM server with AIX OS 5.2 and I do not know if lsof is available for it

 

[KenCunningham]

As Khalid says, lsof is available on the linux toolbox cd provided with the AIX 5.2 package.

 

[icecubegr]

hmmm... sorry men if i sound stupid before... i have never done installation on AIX

I am not the administrator of the system so I have to ask them if they have to install it

Really thanks

 

[KenCunningham]

Alternatively, they can download the rpm from here:

http://www-03.ibm.com/servers/aix/products/aixos/linux/download.html

Good luck.

 

[ogniemi]

pre-compiled lsof for 32bit or 63 bit AIX'es you can find here:

http://ftp.cerias.purdue.edu/pub/tools/unix/sysutils/lsof/binaries/aix/

 

[KenCunningham]

Hmm. Never used the 63 bit version ;-)

 

[mbourne2006]

Hi
"svmon" can reveal inode locks on a process-by-process basis. I've found this useful in the past when "fuser" has not been able to show me which processes were preventing me from unmounting some filesystems.
HTH

Kind Regards,
Matthew Bourne
"Find a job you love and never do a day's work in your life.

 

[icecubegr]

We have the linux toolbox cd... does anyone know the fileset that has to be installed in order to have 'lsof' in the system?

 

[KenCunningham]

Link to the toolbox readme:

ftp://ftp.software.ibm.com/aix/freeSoftware/aixtoolbox/README.txt

You should be able to find the lsof rpm without too much difficulty.

 

[mrn]

man ipcs

Mike

"Whenever I dwell for any length of time on my own shortcomings, they gradually begin to seem mild, harmless, rather engaging little things, not at all like the staring defects in other people's characters."

 

[icecubegr]

I installed 'lsof' successfully but when I run I get all information I do not need but NOT the only thing I need. I get many columns that are no need for me. One of them displays the file system name (and next to it the logical volume name) but no the name of the file.

I read some man pages on internet for 'lsof' but I did not find a way to display the file name instead of file system name.

I JUST want to give a process ID and get a list of file names opened by that process. No pipes, links or any other kind of special files... nomral data files in order to analyses their performance. How difficult can it be? :-(

It will be BIG help for me

 

[mbourne2006]

http://publib.boulder.ibm.com/infocenter/pseries/v5r3/index.jsp

Go to command reference, and look up svmon & ncheck.

According to the docs, something like:

svmon -P $PID -f -j

would give you a list of files open by process $PID

If you omit $PID, you may get a list for all processes, I'm not sure.
The docs do say that you need to be cautious with "-j" as it can have a large overhead, depending on how deeply nested your filesystems are.

Failing that, you can get open inode numbers and LV names from svmon and process the output through ncheck. More work this way, I'd say

HTH


Kind Regards,
Matthew Bourne
"Find a job you love and never do a day's work in your life.

 

[RMGBELGIUM]

Very helpful command mbourne ! didn't know that one yet.
Let's say you have that problem, you get an open file returned by the command,but when you look in your processes, there is no process related to that open file.
Is there a way of getting the file closed in that situation,so the FS can be unmounted?

rgds,

R.