1.\" $OpenBSD: fstat.1,v 1.59 2019/03/31 06:40:26 jmc Exp $ 2.\" 3.\" Copyright (c) 1987, 1991, 1993 4.\" The Regents of the University of California. All rights reserved. 5.\" 6.\" Redistribution and use in source and binary forms, with or without 7.\" modification, are permitted provided that the following conditions 8.\" are met: 9.\" 1. Redistributions of source code must retain the above copyright 10.\" notice, this list of conditions and the following disclaimer. 11.\" 2. Redistributions in binary form must reproduce the above copyright 12.\" notice, this list of conditions and the following disclaimer in the 13.\" documentation and/or other materials provided with the distribution. 14.\" 3. Neither the name of the University nor the names of its contributors 15.\" may be used to endorse or promote products derived from this software 16.\" without specific prior written permission. 17.\" 18.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 19.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 20.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 21.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 22.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 23.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 24.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 25.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 26.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 27.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 28.\" SUCH DAMAGE. 29.\" 30.\" from: @(#)fstat.1 8.3 (Berkeley) 2/25/94 31.\" 32.Dd $Mdocdate: March 31 2019 $ 33.Dt FSTAT 1 34.Os 35.Sh NAME 36.Nm fstat 37.Nd display status of open files 38.Sh SYNOPSIS 39.Nm fstat 40.Op Fl fnosv 41.Op Fl M Ar core 42.Op Fl N Ar system 43.Op Fl p Ar pid 44.Op Fl u Ar user 45.Op Ar 46.Sh DESCRIPTION 47.Nm 48identifies open files. 49A file is considered open by a process if it was explicitly opened, 50is the working directory, root directory, active executable text, or kernel 51trace file for that process. 52If no options are specified, 53.Nm 54reports on all open files in the system. 55.Pp 56The options are as follows: 57.Bl -tag -width Ds 58.It Fl f 59Restrict examination to files open in the same file systems as 60the named file arguments, or to the file system containing the 61current directory if there are no additional filename arguments. 62For example, to find all files open in the file system where the 63directory 64.Pa /usr/src 65resides, type 66.Pp 67.Dl # fstat -f /usr/src 68.It Fl M Ar core 69Extract values associated with the name list from the specified core 70instead of the running kernel. 71.It Fl N Ar system 72Extract the name list from the specified system instead of the running kernel. 73.It Fl n 74Numerical format. 75Print the device number (maj,min) of the file system 76the file resides in rather than the mount point name. 77For special files, print the 78device number that the special device refers to rather than the filename 79in 80.Pa /dev . 81Also, print the mode of the file in octal instead of symbolic form. 82.It Fl o 83Output file offset. 84Follow the size field with the descriptor's offset. 85Useful for checking progress as a process works through a large file. 86This information is only visible to the user or superuser. 87.It Fl p Ar pid 88Report all files open by the specified process. 89This option may be specified multiple times. 90.It Fl s 91Report per file io statistics in two additional columns 92.Sq XFERS 93and 94.Sq KBYTES . 95This information is only visible to the user or superuser. 96.It Fl u Ar user 97Report all files open by the specified user. 98This option may be specified multiple times. 99.It Fl v 100Verbose mode. 101Print error messages upon failures to locate particular 102system data structures rather than silently ignoring them. 103Most of these data structures are dynamically created or deleted and it is 104possible for them to disappear while 105.Nm 106is running. 107This is normal and unavoidable since the rest of the system is running while 108.Nm 109itself is running. 110.It Ar 111Restrict reports to the specified files. 112.El 113.Pp 114The following fields are printed: 115.Bl -tag -width MOUNT 116.It Li USER 117The username of the owner of the process (effective UID). 118.It Li CMD 119The command name of the process. 120.It Li PID 121The process ID. 122.It Li FD 123The file number in the per-process open file table or one of the following 124special names: 125.Pp 126.Bl -tag -width "text" -offset indent -compact 127.It text 128executable text inode 129.It wd 130current working directory 131.It root 132root inode 133.It tr 134kernel trace file 135.El 136.Pp 137If the file number is followed by an asterisk 138.Pq Ql * , 139the file is not an inode, but rather a socket, or there is an error. 140In this case the remainder of the line doesn't 141correspond to the remaining headers \(em the format of the line 142is described later under 143.Sx SOCKETS . 144.It Li MOUNT 145If the 146.Fl n 147flag wasn't specified, this header is present and is the 148pathname that the file system the file resides in is mounted on. 149.It Li DEV 150If the 151.Fl n 152flag is specified, this header is present and is the 153major/minor number of the device that this file resides in. 154.It Li INUM 155The inode number of the file. 156It will be followed by an asterisk 157.Pq Ql * 158if the inode is unlinked from disk. 159.It Li MODE 160The mode of the file. 161If the 162.Fl n 163flag isn't specified, the mode is printed 164using a symbolic format (see 165.Xr strmode 3 ) ; 166otherwise, the mode is printed 167as an octal number. 168.It Li R/W 169This column describes the properties of the file descriptor: 170.Pp 171.Bl -tag -width indent -compact 172.It r 173Open for reading 174.It w 175Open for writing 176.It e 177close-on-exec flag is set 178.It p 179Opened after 180.Xr pledge 2 181.El 182.Pp 183This field is useful when trying to find the processes that are 184preventing a file system from being downgraded to read-only. 185.It Li SZ | DV 186If the file is not a character or block special file, prints the size of 187the file in bytes. 188Otherwise, if the 189.Fl n 190flag is not specified, prints 191the name of the special file as located in 192.Pa /dev . 193If that cannot be located, or the 194.Fl n 195flag is specified, prints the major/minor device 196number that the special device refers to. 197.It Li NAME 198If filename arguments are specified and the 199.Fl f 200flag is not, then 201this field is present and is the name associated with the given file. 202Normally the name cannot be determined since there is no mapping 203from an open file back to the directory entry that was used to open 204that file. 205Also, since different directory entries may reference 206the same file (via 207.Xr ln 1 ) , 208the name printed may not be the actual 209name that the process originally used to open that file. 210.It Li XFERS 211Displays number of total data transfers performed on the file. 212.It Li KBYTES 213Displays total number of Kbytes written and read to the file. 214.El 215.Sh SOCKETS 216The formatting of open sockets depends on the protocol domain. 217In all cases the first field is the domain name 218and the second field is the socket type (stream, dgram, etc). 219The remaining fields are protocol dependent. 220For TCP, it is the address of the tcpcb, and for UDP, the inpcb (socket pcb). 221For 222.Ux Ns -domain 223sockets, it's the address of the socket pcb and the address 224of the connected pcb (if connected). 225Otherwise the protocol number and address of the socket itself are printed. 226The attempt is to make enough information available to 227permit further analysis without duplicating 228.Xr netstat 1 . 229.Pp 230For example, the addresses mentioned above are the addresses which the 231.Ic netstat -A 232command would print for TCP, UDP, and 233.Ux Ns -domain. 234These addresses are only visible to the superuser, otherwise 0x0 is printed. 235Sockets that have been disassociated from a protocol control block 236will always print 0x0. 237A unidirectional 238.Ux Ns -domain 239socket indicates the direction of flow with 240an arrow 241.Pf ( Dq <- 242or 243.Dq -> ) , 244and a full duplex socket shows a double arrow 245.Pq Dq <-> . 246.Pp 247For 248.Dv AF_INET 249and 250.Dv AF_INET6 251sockets, 252.Nm 253also attempts to print the internet address and port for the 254local end of a connection. 255If the socket is connected, it also prints the remote internet address 256and port. 257A 258.Ql * 259is used to indicate an 260.Dv INADDR_ANY 261binding. 262In this case, the 263use of the arrow 264.Pf ( Dq <-- 265or 266.Dq --> ) 267indicates the direction the socket connection was created. 268.Pp 269If the socket has been spliced to or from another socket (see 270.Xr setsockopt 2 271and 272.Dv SO_SPLICE ) 273then 274.Nm 275prints a thick arrow 276.Pf ( Dq <==> , 277.Dq <== , 278or 279.Dq ==> ) , 280followed by the address and endpoint information of the other socket 281in the splice, 282if available. 283.Sh PIPES 284Every pipe is printed as an address which is the same for both sides of 285the pipe and a state that is built of the letters 286.Dq RWE . 287W \- The pipe blocks waiting for the reader to read data. 288R \- The pipe blocks waiting for the writer to write data. 289E \- The pipe is in EOF state. 290.Sh KQUEUE 291Each 292.Xr kqueue 2 293is printed with some information as to queue length. 294Since these things are normally serviced quickly, it is likely that 295nothing of real importance can be discerned. 296.Sh SEE ALSO 297.Xr netstat 1 , 298.Xr nfsstat 1 , 299.Xr ps 1 , 300.Xr systat 1 , 301.Xr top 1 , 302.Xr iostat 8 , 303.Xr pstat 8 , 304.Xr tcpdrop 8 , 305.Xr vmstat 8 306.Sh HISTORY 307The 308.Nm 309command appeared in 310.Bx 4.3 tahoe . 311.Sh CAVEATS 312Sockets in use by the kernel, such as those opened by 313.Xr nfsd 8 , 314will not be seen by 315.Nm , 316even though they appear in 317.Xr netstat 1 . 318.Sh BUGS 319Since 320.Nm 321takes a snapshot of the system, it is only correct for a very short period 322of time. 323.Pp 324Moreover, because DNS resolution and YP lookups cause many file 325descriptor changes, 326.Nm 327does not attempt to translate the internet address and port numbers into 328symbolic names. 329