Solaris

I just tried 'file' command. It simply says if its 'data' or 'ascii text'.

I don't have access to 'procfiles' command, if someone has access to that comand I would like to see what they see for FDs that point to disk but not the actual file.

So you have the process, the file descriptor and the file content. What are you missing ?

And what is this "procfiles" command you are referring to ? If it is the AIX one, /usr/proc/bin/pfiles is the equivalent on Solaris.

Solaris also has "find /export -mount -ls" displaying inode on the front, so you can identify the file name from the inode #, if it is still linked to any dir. (slow, but . . . .).

And if you think it is being written, there is "truss -wall -p" to show you what it is writing.

I made some progress. Answer for my question is this command.

Code:

 
$> find / -inum <[I]NODE> -print 2>/dev/null 
/export/<full_path>/<filename>
/proc/<PID#>/fd/<FD#>
/proc/<PID#>/object/ufs.85.3.<INODE#>

Following command simply proves relation between FD and PID.
Now my problem is it took close to 3 minutes to finish that one find command.
I am planning to do this for all FD#s for all PID#s on the system.

Is there way to get that quicker!?
How can I only get actual filename and not other two entries from /proc/<PID#>/..?

So you mean lsof doesn't show the filename for a given inode number pair, but find found a real pathname for the same inode ?

I do not have lsof to play with this month, so I am working from memory, but I thought it used to show me paths. I can see the path info can be difficult/expensive to acquire in some cases, especially the deleted dir entry case where there may be none, so I can roll with a inode-device display for speed.

If this is your own process, you can truss it from the start and know what each fd is, and what it is up to.

It is a security feature, for one thing. It prevents literally any other process (not part of the process tree if fd's are shared parent->child ) from being able to open the file, get the filename or to perform read or write or open on file contents.