1.\" $OpenBSD: fstat.1,v 1.46 2011/05/02 11:14:11 jmc Exp $ 2.\" 3.\" Copyright (c) 1987, 1991, 1993 4.\" The Regents of the University of California. All rights reserved. 5.\" 6.\" Redistribution and use in source and binary forms, with or without 7.\" modification, are permitted provided that the following conditions 8.\" are met: 9.\" 1. Redistributions of source code must retain the above copyright 10.\" notice, this list of conditions and the following disclaimer. 11.\" 2. Redistributions in binary form must reproduce the above copyright 12.\" notice, this list of conditions and the following disclaimer in the 13.\" documentation and/or other materials provided with the distribution. 14.\" 3. Neither the name of the University nor the names of its contributors 15.\" may be used to endorse or promote products derived from this software 16.\" without specific prior written permission. 17.\" 18.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 19.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 20.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 21.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 22.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 23.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 24.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 25.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 26.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 27.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 28.\" SUCH DAMAGE. 29.\" 30.\" from: @(#)fstat.1 8.3 (Berkeley) 2/25/94 31.\" 32.Dd $Mdocdate: May 2 2011 $ 33.Dt FSTAT 1 34.Os 35.Sh NAME 36.Nm fstat 37.Nd display status of open files 38.Sh SYNOPSIS 39.Nm fstat 40.Op Fl fnosv 41.Op Fl M Ar core 42.Op Fl N Ar system 43.Op Fl p Ar pid 44.Op Fl u Ar user 45.Op Ar 46.Sh DESCRIPTION 47.Nm 48identifies open files. 49A file is considered open by a process if it was explicitly opened, 50is the working directory, root directory, active executable text, or kernel 51trace file for that process. 52If no options are specified, 53.Nm 54reports on all open files in the system. 55.Pp 56The options are as follows: 57.Bl -tag -width Ds 58.It Fl f 59Restrict examination to files open in the same file systems as 60the named file arguments, or to the file system containing the 61current directory if there are no additional filename arguments. 62For example, to find all files open in the file system where the 63directory 64.Pa /usr/src 65resides, type 66.Pp 67.Dl # fstat -f /usr/src 68.It Fl M Ar core 69Extract values associated with the name list from the specified core 70instead of the running kernel. 71.It Fl N Ar system 72Extract the name list from the specified system instead of the running kernel. 73.It Fl n 74Numerical format. 75Print the device number (maj,min) of the file system 76the file resides in rather than the mount point name. 77For special files, print the 78device number that the special device refers to rather than the filename 79in 80.Pa /dev . 81Also, print the mode of the file in octal instead of symbolic form. 82.It Fl o 83Output file offset. 84Follow the size field with the descriptor's offset. 85Useful for checking progress as a process works through a large file. 86This information is only visible to the user or superuser. 87.It Fl p Ar pid 88Report all files open by the specified process. 89.It Fl s 90Report per file io statistics in two additional columns 91.Sq XFERS 92and 93.Sq KBYTES . 94This information is only visible to the user or superuser. 95.It Fl u Ar user 96Report all files open by the specified user. 97.It Fl v 98Verbose mode. 99Print error messages upon failures to locate particular 100system data structures rather than silently ignoring them. 101Most of these data structures are dynamically created or deleted and it is 102possible for them to disappear while 103.Nm 104is running. 105This is normal and unavoidable since the rest of the system is running while 106.Nm 107itself is running. 108.It Ar 109Restrict reports to the specified files. 110.El 111.Pp 112The following fields are printed: 113.Bl -tag -width MOUNT 114.It Li USER 115The username of the owner of the process (effective UID). 116.It Li CMD 117The command name of the process. 118.It Li PID 119The process ID. 120.It Li FD 121The file number in the per-process open file table or one of the following 122special names: 123.Bd -literal -offset indent 124text \- executable text inode 125wd \- current working directory 126root \- root inode 127tr \- kernel trace file 128.Ed 129.Pp 130If the file number is followed by an asterisk 131.Pq Ql * , 132the file is not an inode, but rather a socket, or there is an error. 133In this case the remainder of the line doesn't 134correspond to the remaining headers -- the format of the line 135is described later under 136.Sx SOCKETS . 137.It Li MOUNT 138If the 139.Fl n 140flag wasn't specified, this header is present and is the 141pathname that the file system the file resides in is mounted on. 142.It Li DEV 143If the 144.Fl n 145flag is specified, this header is present and is the 146major/minor number of the device that this file resides in. 147.It Li INUM 148The inode number of the file. 149.It Li MODE 150The mode of the file. 151If the 152.Fl n 153flag isn't specified, the mode is printed 154using a symbolic format (see 155.Xr strmode 3 ) ; 156otherwise, the mode is printed 157as an octal number. 158.It Li R/W 159This column describes the access mode that the file allows. 160The letter 161.Sq r 162indicates open for reading; 163the letter 164.Sq w 165indicates open for writing. 166This field is useful when trying to find the processes that are 167preventing a file system from being downgraded to read-only. 168.It Li SZ | DV 169If the file is not a character or block special file, prints the size of 170the file in bytes. 171Otherwise, if the 172.Fl n 173flag is not specified, prints 174the name of the special file as located in 175.Pa /dev . 176If that cannot be located, or the 177.Fl n 178flag is specified, prints the major/minor device 179number that the special device refers to. 180.It Li NAME 181If filename arguments are specified and the 182.Fl f 183flag is not, then 184this field is present and is the name associated with the given file. 185Normally the name cannot be determined since there is no mapping 186from an open file back to the directory entry that was used to open 187that file. 188Also, since different directory entries may reference 189the same file (via 190.Xr ln 1 ) , 191the name printed may not be the actual 192name that the process originally used to open that file. 193.It Li XFERS 194Dislays number of total data transfers performed on the file. 195.It Li KBYTES 196Displays total number of Kbytes written and read to the file. 197.El 198.Sh SOCKETS 199The formatting of open sockets depends on the protocol domain. 200In all cases the first field is the domain name 201and the second field is the socket type (stream, dgram, etc). 202The remaining fields are protocol dependent. 203For TCP, it is the address of the tcpcb, and for UDP, the inpcb (socket pcb). 204For 205.Ux Ns -domain 206sockets, it's the address of the socket pcb and the address 207of the connected pcb (if connected). 208Otherwise the protocol number and address of the socket itself are printed. 209The attempt is to make enough information available to 210permit further analysis without duplicating 211.Xr netstat 1 . 212.Pp 213For example, the addresses mentioned above are the addresses which the 214.Ic netstat -A 215command would print for TCP, UDP, and 216.Ux Ns -domain. 217A unidirectional 218.Ux Ns -domain 219socket indicates the direction of flow with 220an arrow 221.Pf ( Dq <- 222or 223.Dq -> ) , 224and a full duplex socket shows a double arrow 225.Pq Dq <-> . 226.Pp 227For 228.Dv AF_INET 229sockets, 230.Nm 231also attempts to print the internet address and port for the 232local end of a connection. 233If the socket is connected, it also prints the remote internet address 234and port. 235A 236.Ql * 237is used to indicate an 238.Dv INADDR_ANY 239binding. 240In this case, the 241use of the arrow 242.Pf ( Dq <-- 243or 244.Dq --> ) 245indicates the direction the socket connection was created. 246.Sh PIPES 247Every pipe is printed as an address which is the same for both sides of 248the pipe and a state that is built of the letters 249.Dq RWE . 250W \- The pipe blocks waiting for the reader to read data. 251R \- The pipe blocks waiting for the writer to write data. 252E \- The pipe is in EOF state. 253.Sh CRYPTO 254Each 255.Xr crypto 4 256device is printed with only the kernel address of the device private data. 257.Sh KQUEUE 258Each 259.Xr kqueue 2 260is printed with some information as to queue length. 261Since these things are normally serviced quickly, it is likely that 262nothing of real importance can be discerned. 263.Sh SYSTRACE 264Each 265.Xr systrace 4 266device is printed with only the kernel address of the 267device private data. 268.Sh SEE ALSO 269.Xr netstat 1 , 270.Xr nfsstat 1 , 271.Xr ps 1 , 272.Xr systat 1 , 273.Xr top 1 , 274.Xr iostat 8 , 275.Xr pstat 8 , 276.Xr tcpdrop 8 , 277.Xr vmstat 8 278.Sh HISTORY 279The 280.Nm 281command appeared in 282.Bx 4.3 tahoe . 283.Sh CAVEATS 284Sockets in use by the kernel, such as those opened by 285.Xr nfsd 8 , 286will not be seen by 287.Nm , 288even though they appear in 289.Xr netstat 1 . 290.Sh BUGS 291Since 292.Nm 293takes a snapshot of the system, it is only correct for a very short period 294of time. 295.Pp 296Moreover, because DNS resolution and YP lookups cause many file 297descriptor changes, 298.Nm 299does not attempt to translate the internet address and port numbers into 300symbolic names. 301