Re: Determining file name with /proc/pid/fd/#?

From: Victor A Abell (abe_at_quest.cc.purdue.edu)
Date: 09/21/05


Date: 21 Sep 05 08:50:09 EST

Casper H.S. Dik <Casper.Dik@Sun.COM> writes:

>abe@quest.cc.purdue.edu (Victor A Abell) writes:

>>As for how this applies to the original question about unlinked paths,
>>it appears that /proc/<pid>/path/... will not be a symbolic link to
>>anything if the file has been unlinked. The hint remains in the
>>vnode's v_path, but there's no way to validate it. It might sometimes
>>be useful to report the hint, if it could be shown as only a hint and
>>not a certainty.

>Yes, but an unlinked file has no name, really ...

However, I think that's what the OP wanted to know. It seems a useful
item of information to me to know the path name under which a deleted
file was opened.

>(Last time I checked, Linux also gets a number of cases wrong in
>/proc)

I've not seen that, but I have seen many cases where the Linux /proc
file system does get the path name correct, even after components of
the path have been renamed. Moreover, Linux /proc reports "(deleted)"
at the end of the open file's last known path when the file has been
unlinked.

Lsof 4.77 will have an option to make a similar "(deleted)" report.
Anyone who wants a look at that can try this 4.77 pre-release:

ftp://lsof.itap.purdue.edu/pub/tools/unix/lsof/NEW/lsof_4.77A.sun.tar.bz2

The -X option must be specified to lsof 4.77 to get the "(deleted)"
path name report. There are some new FAQ entries discussing the cached
vnode path name lsof uses.

Vic



Relevant Pages

  • Re: Backup failed!
    ... When I defined a report, I got the error, now I just need to know "Why do ... SQLServer says it delete a file, ... > step and catch the error messages in the output file. ... >> Nope, there is no hint, the best hint is ...
    (microsoft.public.sqlserver.programming)
  • Re: Cyclist hit and runs - what is the answer?
    ... > Tony W wrote: ... >> Hint: uk.rec.CYCLING ... according to the report, the car had just come off a dual carriageway ...
    (uk.rec.cycling)
  • Re: Tornovoz
    ... right' without any hint of what those details might be. ... common thread is that it seems to work best on smaller guitars. ... they tend to be loud but 'treble ... I'm sorry to report that I can not divulge my report of these ...
    (rec.music.classical.guitar)
  • Iran derides US military option
    ... military action to halt its nuclear program and gave no hint of ... U.S. and friendly nation laws prohibit fully ... with our laws this report cannot be provided in ... Military News and Information Editor ...
    (soc.culture.iranian)
  • Re: B-25G/H Models with 75mm Nose Cannon
    ... places and did not report it- you are equally guilty. ... (For a hint, but only a tiny hint, of the origins of this corner of the ... military mentality, look up "counting coup".) ...
    (rec.aviation.military)