1.\" $NetBSD: fstat.1,v 1.30 2011/10/08 22:16:03 jnemeth Exp $ 2.\" 3.\" Copyright (c) 1987, 1991, 1993 4.\" The Regents of the University of California. All rights reserved. 5.\" 6.\" Redistribution and use in source and binary forms, with or without 7.\" modification, are permitted provided that the following conditions 8.\" are met: 9.\" 1. Redistributions of source code must retain the above copyright 10.\" notice, this list of conditions and the following disclaimer. 11.\" 2. Redistributions in binary form must reproduce the above copyright 12.\" notice, this list of conditions and the following disclaimer in the 13.\" documentation and/or other materials provided with the distribution. 14.\" 3. Neither the name of the University nor the names of its contributors 15.\" may be used to endorse or promote products derived from this software 16.\" without specific prior written permission. 17.\" 18.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 19.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 20.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 21.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 22.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 23.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 24.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 25.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 26.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 27.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 28.\" SUCH DAMAGE. 29.\" 30.\" from: @(#)fstat.1 8.3 (Berkeley) 2/25/94 31.\" 32.Dd September 5, 2011 33.Dt FSTAT 1 34.Os 35.Sh NAME 36.Nm fstat 37.Nd display status of open files 38.Sh SYNOPSIS 39.Nm 40.Op Fl fnv 41.Op Fl M Ar core 42.Op Fl N Ar system 43.Op Fl p Ar pid 44.Op Fl u Ar user 45.Op Ar 46.Sh DESCRIPTION 47.Nm 48identifies open files. 49A file is considered open by a process if it was explicitly opened, 50is the working directory, root directory, active pure text, or kernel 51trace file for that process. 52If no options are specified, 53.Nm 54reports on all open files in the system. 55.Pp 56Options: 57.Bl -tag -width Ds 58.It Fl f 59Restrict examination to files open in the same file systems as 60the named file arguments, or to the file system containing the 61current directory if there are no additional filename arguments. 62For example, to find all files open in the file system where the 63directory 64.Pa /usr/src 65resides, type 66.Dq Li fstat -f /usr/src . 67Please see the 68.Sx BUGS 69section for issues with this option. 70.It Fl M 71Extract values associated with the name list from the specified core 72instead of the default 73.Pa /dev/kmem . 74.It Fl N 75Extract the name list from the specified system instead of the default 76.Pa /netbsd . 77.It Fl n 78Numerical format. 79Print the device number (maj,min) of the file system 80the file resides in rather than the mount point name; for special 81files, print the 82device number that the special device refers to rather than the filename 83in 84.Pa /dev ; 85and print the mode of the file in octal instead of symbolic form. 86.It Fl p 87Report all files open by the specified process. 88.It Fl u 89Report all files open by the specified user. 90.It Fl v 91Verbose mode. 92Print error messages upon failures to locate particular 93system data structures rather than silently ignoring them. 94Most of 95these data structures are dynamically created or deleted and it is 96possible for them to disappear while 97.Nm 98is running. 99This 100is normal and unavoidable since the rest of the system is running while 101.Nm 102itself is running. 103.It Ar 104Restrict reports to the specified files. 105.El 106.Pp 107The following fields are printed: 108.Bl -tag -width MOUNT 109.It Li USER 110The username of the owner of the process (effective UID). 111.It Li CMD 112The command name of the process. 113.It Li PID 114The process ID. 115.It Li FD 116The file number in the per-process open file table or one of the following 117special names: 118.Pp 119.Bl -tag -width MOUNT -offset indent -compact 120.It Li text 121pure text inode 122.It Li wd 123current working directory 124.It Li root 125root inode 126.It Li tr 127kernel trace file 128.El 129.Pp 130If the file number is followed by an asterisk 131.Pq Dq * , 132the file is not an inode, but rather a socket, 133.Tn FIFO , 134or there is an error. 135In this case the remainder of the line doesn't 136correspond to the remaining headers -- the format of the line 137is described later under 138.Sx SOCKETS . 139.It Li MOUNT 140If the 141.Fl n 142flag wasn't specified, this header is present and is the 143pathname that the file system the file resides in is mounted on. 144.It Li DEV 145If the 146.Fl n 147flag is specified, this header is present and is the 148major/minor number of the device that this file resides in. 149.It Li INUM 150The inode number of the file. 151.It Li MODE 152The mode of the file. 153If the 154.Fl n 155flag isn't specified, the mode is printed 156using a symbolic format (see 157.Xr strmode 3 ) ; 158otherwise, the mode is printed 159as an octal number. 160.It Li SZ\&|DV 161If the file is not a character or block special file, prints the size of 162the file in bytes. 163Otherwise, if the 164.Fl n 165flag is not specified, prints 166the name of the special file as located in 167.Pa /dev . 168If that cannot be 169located, or the 170.Fl n 171flag is specified, prints the major/minor device 172number that the special device refers to. 173.It Li R/W 174This column describes the access mode that the file allows. 175The letter 176.Dq r 177indicates open for reading; 178the letter 179.Dq w 180indicates open for writing. 181This field is useful when trying to find the processes that are 182preventing a file system from being downgraded to read-only. 183.It Li NAME 184If filename arguments are specified and the 185.Fl f 186flag is not, then 187this field is present and is the name associated with the given file. 188Normally the name cannot be determined since there is no mapping 189from an open file back to the directory entry that was used to open 190that file. 191Also, since different directory entries may reference 192the same file (via 193.Xr ln 1 ) , 194the name printed may not be the actual 195name that the process originally used to open that file. 196.El 197.Sh SOCKETS 198The formatting of open sockets depends on the protocol domain. 199In all cases the first field is the domain name and 200the second field is the socket type (stream, dgram, etc.). 201The remaining fields are protocol dependent. 202For TCP, it is the address of the tcpcb, and for UDP, the inpcb (socket pcb). 203For 204.Ux 205domain sockets, its the address of the socket pcb and the name of the 206file if available. 207Otherwise the address of the connected pcb is printed (if connected). 208For other domains, the protocol number and address of the socket itself 209are printed. 210The attempt is to make enough information available to 211permit further analysis without duplicating 212.Xr netstat 1 . 213.Pp 214For example, the addresses mentioned above are the addresses which the 215.Dq Li netstat -A 216command would print for TCP, UDP, and 217.Ux 218domain. 219For kernels compiled with 220.Dv PIPE_SOCKETPAIR 221pipes appear as connected 222.Ux 223domain stream sockets. 224A unidirectional 225.Ux 226domain socket indicates the direction of flow with an arrow 227.Po 228.Dq \*[Lt]- 229or 230.Dq -\*[Gt] 231.Pc , 232and a full duplex socket shows a double arrow 233.Pq Dq \*[Lt]-\*[Gt] . 234.Pp 235For internet sockets 236.Nm fstat 237also attempts to print the internet address and port for the 238local end of a connection. 239If the socket is connected, it also prints the remote internet address 240and port. 241An asterisk 242.Pq Dq * 243is used to indicate an INADDR_ANY binding. 244.Sh SEE ALSO 245.Xr netstat 1 , 246.Xr nfsstat 1 , 247.Xr ps 1 , 248.Xr sockstat 1 , 249.Xr systat 1 , 250.Xr vmstat 1 , 251.Xr fstat 2 , 252.Xr iostat 8 , 253.Xr pstat 8 254.Sh HISTORY 255The 256.Nm 257command appeared in 258.Bx 4.3 tahoe . 259.Sh BUGS 260Since 261.Nm 262takes a snapshot of the system, it is only correct for a very short period 263of time. 264.Pp 265Moreover, because DNS resolution and YP lookups cause many file 266descriptor changes, 267.Nm 268does not attempt to translate the internet address and port numbers into 269symbolic names. 270.Pp 271Note that the 272.Fl f 273option will not list 274.Ux 275domain sockets open in the file system, because the pathnames in the sockets 276may not be absolute and are not deterministic. 277To find all the 278.Ux 279domain sockets, use 280.Nm 281to list all the sockets, and look for the ones that maybe belong in the 282file system. 283