Copyright (c) 1980 Regents of the University of California.
All rights reserved. The Berkeley software License Agreement
specifies the terms and conditions for redistribution.

@(#)fstat.1 5.2 (Berkeley) 10/11/87

C 4 fstat - file status fstat [ -u user ] [ -p pid ] [ -f filename ]

fstat filename [ filename... ]

Fstat identifies open files. A file is considered open if a process has it open, if it is the working directory for a process, or if it is an active pure text file. If no options are specified, fstat reports on all open files.

Options:

6 -u Report all files open by a specified user.

6 -p Report all files open by a specified process id.

6 -f Restrict reports to the specified file. If the file is a block special file, fstat additionally reports on any open files on that device, treating it as a mounted file system.

If more than one type of option is specified, files must match the criteria of each option specified. More than one file flag may be present. In particular, one may say "fstat foo* bar*" and the right thing will happen.

The following fields are printed

6 USER The username of the owner of the process.

6 CMD The command name of the process.

6 PID The process id.

6 FD The file number in the per-process open file table. The special names "text" and "wd" mean that the file is the pure text inode or the working directory for the process. If the file number is followed by an asterick (*), then the file is not an inode, but either a socket, fifo, or has an error of some kind. In this case the rest of the entry is variable format, doesn't correspond to the rest of the headings, and is enclosed in parenthesis. The following paragraph describing sockets will explain the variable format.

6 DEVICE Major minor number of the device this file exists on.

6 INODE The inode number of the file.

6 SIZE The size in bytes of the file.

6 TYPE The type of the file. (see stat(2))

Sockets The variable formatting of open sockets depends on the protocol domain of the socket. In all cases the first field is the name of the domain, the second field is the socket type (stream, dgram, etc), and the third is the socket flags (in hex). The rest are protocol dependent. For tcp, it is the address of the tcpcb, for udp, the inpcb (socket pcb). For unix domain, its the address of the socket pcb and the address of the connected pcb (if connected). Otherwise the protocol number and address of the socket itself are printed. The idea is not to duplicate netstat, but to make available enough information for further analysis. For example, the addresses mentioned above are the addresses which the "netstat -A" command would print for tcp, udp, and unixdomain. Note that since pipe(2) is implemented with sockets, a pipe appears as a connected unixdomain stream socket. .dt

Socket information clutters the output. It should be possible to specify more than one of each type of argument. A logical or connective would be nice. ps(1), stat(2), pstat(8)