1.\" $NetBSD: fstat.1,v 1.31 2012/10/03 19:35:08 wiz Exp $ 2.\" 3.\" Copyright (c) 1987, 1991, 1993 4.\" The Regents of the University of California. All rights reserved. 5.\" 6.\" Redistribution and use in source and binary forms, with or without 7.\" modification, are permitted provided that the following conditions 8.\" are met: 9.\" 1. Redistributions of source code must retain the above copyright 10.\" notice, this list of conditions and the following disclaimer. 11.\" 2. Redistributions in binary form must reproduce the above copyright 12.\" notice, this list of conditions and the following disclaimer in the 13.\" documentation and/or other materials provided with the distribution. 14.\" 3. Neither the name of the University nor the names of its contributors 15.\" may be used to endorse or promote products derived from this software 16.\" without specific prior written permission. 17.\" 18.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 19.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 20.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 21.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 22.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 23.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 24.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 25.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 26.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 27.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 28.\" SUCH DAMAGE. 29.\" 30.\" from: @(#)fstat.1 8.3 (Berkeley) 2/25/94 31.\" 32.Dd September 5, 2011 33.Dt FSTAT 1 34.Os 35.Sh NAME 36.Nm fstat 37.Nd display status of open files 38.Sh SYNOPSIS 39.Nm 40.Op Fl fnv 41.Op Fl M Ar core 42.Op Fl N Ar system 43.Op Fl p Ar pid 44.Op Fl u Ar user 45.Op Ar 46.Sh DESCRIPTION 47.Nm 48identifies open files. 49A file is considered open by a process if it was explicitly opened, 50is the working directory, root directory, active pure text, or kernel 51trace file for that process. 52If no options are specified, 53.Nm 54reports on all open files in the system. 55.Pp 56Options: 57.Bl -tag -width Ds 58.It Fl f 59Restrict examination to files open in the same file systems as 60the named file arguments, or to the file system containing the 61current directory if there are no additional filename arguments. 62For example, to find all files open in the file system where the 63directory 64.Pa /var/log 65resides, type 66.Dq Li fstat -f /var/log . 67Please see the 68.Sx BUGS 69section for issues with this option. 70.It Fl M 71Extract values associated with the name list from the specified core 72instead of the default 73.Pa /dev/kmem . 74.It Fl N 75Extract the name list from the specified system instead of the default 76.Pa /netbsd . 77.It Fl n 78Numerical format. 79Print the device number (maj,min) of the file system 80the file resides in rather than the mount point name; for special 81files, print the 82device number that the special device refers to rather than the filename 83in 84.Pa /dev ; 85and print the mode of the file in octal instead of symbolic form. 86.It Fl p 87Report all files open by the specified process. 88.It Fl u 89Report all files open by the specified user. 90.It Fl v 91Verbose mode. 92Print error messages upon failures to locate particular 93system data structures rather than silently ignoring them. 94Most of 95these data structures are dynamically created or deleted and it is 96possible for them to disappear while 97.Nm 98is running. 99This is normal and unavoidable since the rest of the system is running while 100.Nm 101itself is running. 102.It Ar 103Restrict reports to the specified files. 104.El 105.Pp 106The following fields are printed: 107.Bl -tag -width MOUNT 108.It Li USER 109The username of the owner of the process (effective UID). 110.It Li CMD 111The command name of the process. 112.It Li PID 113The process ID. 114.It Li FD 115The file number in the per-process open file table or one of the following 116special names: 117.Pp 118.Bl -tag -width MOUNT -offset indent -compact 119.It Li text 120pure text inode 121.It Li wd 122current working directory 123.It Li root 124root inode 125.It Li tr 126kernel trace file 127.El 128.Pp 129If the file number is followed by an asterisk 130.Pq Dq * , 131the file is not an inode, but rather a socket, 132.Tn FIFO , 133or there is an error. 134In this case the remainder of the line doesn't 135correspond to the remaining headers -- the format of the line 136is described later under 137.Sx SOCKETS . 138.It Li MOUNT 139If the 140.Fl n 141flag wasn't specified, this header is present and is the 142pathname that the file system the file resides in is mounted on. 143.It Li DEV 144If the 145.Fl n 146flag is specified, this header is present and is the 147major/minor number of the device that this file resides in. 148.It Li INUM 149The inode number of the file. 150.It Li MODE 151The mode of the file. 152If the 153.Fl n 154flag isn't specified, the mode is printed 155using a symbolic format (see 156.Xr strmode 3 ) ; 157otherwise, the mode is printed 158as an octal number. 159.It Li SZ\&|DV 160If the file is not a character or block special file, prints the size of 161the file in bytes. 162Otherwise, if the 163.Fl n 164flag is not specified, prints 165the name of the special file as located in 166.Pa /dev . 167If that cannot be 168located, or the 169.Fl n 170flag is specified, prints the major/minor device 171number that the special device refers to. 172.It Li R/W 173This column describes the access mode that the file allows. 174The letter 175.Dq r 176indicates open for reading; 177the letter 178.Dq w 179indicates open for writing. 180This field is useful when trying to find the processes that are 181preventing a file system from being downgraded to read-only. 182.It Li NAME 183If filename arguments are specified and the 184.Fl f 185flag is not, then 186this field is present and is the name associated with the given file. 187Normally the name cannot be determined since there is no mapping 188from an open file back to the directory entry that was used to open 189that file. 190Also, since different directory entries may reference 191the same file (via 192.Xr ln 1 ) , 193the name printed may not be the actual 194name that the process originally used to open that file. 195.El 196.Sh SOCKETS 197The formatting of open sockets depends on the protocol domain. 198In all cases the first field is the domain name and 199the second field is the socket type (stream, dgram, etc.). 200The remaining fields are protocol dependent. 201For TCP, it is the address of the tcpcb, and for UDP, the inpcb (socket pcb). 202For 203.Ux 204domain sockets, its the address of the socket pcb and the name of the 205file if available. 206Otherwise the address of the connected pcb is printed (if connected). 207For other domains, the protocol number and address of the socket itself 208are printed. 209The attempt is to make enough information available to 210permit further analysis without duplicating 211.Xr netstat 1 . 212.Pp 213For example, the addresses mentioned above are the addresses which the 214.Dq Li netstat -A 215command would print for TCP, UDP, and 216.Ux 217domain. 218For kernels compiled with 219.Dv PIPE_SOCKETPAIR 220pipes appear as connected 221.Ux 222domain stream sockets. 223A unidirectional 224.Ux 225domain socket indicates the direction of flow with an arrow 226.Po 227.Dq \*[Lt]- 228or 229.Dq -\*[Gt] 230.Pc , 231and a full duplex socket shows a double arrow 232.Pq Dq \*[Lt]-\*[Gt] . 233.Pp 234For internet sockets 235.Nm 236also attempts to print the internet address and port for the 237local end of a connection. 238If the socket is connected, it also prints the remote internet address 239and port. 240An asterisk 241.Pq Dq * 242is used to indicate an INADDR_ANY binding. 243.Sh SEE ALSO 244.Xr netstat 1 , 245.Xr nfsstat 1 , 246.Xr ps 1 , 247.Xr sockstat 1 , 248.Xr systat 1 , 249.Xr vmstat 1 , 250.Xr fstat 2 , 251.Xr iostat 8 , 252.Xr pstat 8 253.Sh HISTORY 254The 255.Nm 256command appeared in 257.Bx 4.3 tahoe . 258.Sh BUGS 259Since 260.Nm 261takes a snapshot of the system, it is only correct for a very short period 262of time. 263.Pp 264Moreover, because DNS resolution and YP lookups cause many file 265descriptor changes, 266.Nm 267does not attempt to translate the internet address and port numbers into 268symbolic names. 269.Pp 270Note that the 271.Fl f 272option will not list 273.Ux 274domain sockets open in the file system, because the pathnames in the sockets 275may not be absolute and are not deterministic. 276To find all the 277.Ux 278domain sockets, use 279.Nm 280to list all the sockets, and look for the ones that maybe belong in the 281file system. 282