I needed to get the list of files accessed by a process nad its children. I tried using tusc and I got a complete list of read system calls. But how to get the file mane form that output.
This is the command I used:
tusc -kfs read <pid>
and this is the sample of the output I got:
read(3, "02\v010e0512@ \0L 0fO fd\0\0\0\0".., 128) ............................................................................................... = 128
read(3, "10\0\004\0\0\0( \003H \ \0\0\0\0".., 48) ................................................................................................ = 48
read(3, "0214010e0512@ \0\0\0\0\0\0\0\0\0".., 128) ............................................................................................... = 128
read(3, "10\0\004\0\0\0( \016e304\0\010\0".., 48) ................................................................................................ = 48
read(3, "80\0\0\v\0\0\004\0\0\0\0", 12) .......................................................................................................... = 12
read(3, "02\v010e0512@ \0L 0fO fe\0\0\0\0".., 128) ............................................................................................... = 128
read(3, "10\0\004\0\0\0( \0\0) \ \0\010\0".., 48) ................................................................................................ = 48
read(3, "80\0\0\v\0\0\004\0\0\0\0", 12) .......................................................................................................... = 12
read(4, "\0\0018d", 4) ........................................................................................................................... = 4
read(4, "c o n f i g \0\0\0\0\0\0\0\0\0\0".., 17468) ............................................................................................. = 17468
read(4, "# \n# / e t c / n s s w i t c ".., 8192) .............................................................................................. = 370
read(4, 0x4002c1a8, 8192) ........................................................................................................................ = 0
read(4, "0210010e0512@ \0\0\0\0\0\0\0\0\0".., 128) ............................................................................................... = 128
read(4, "10\0\004\0\0\0( \0\08d04\0\010\0".., 48) ................................................................................................ = 48
read(4, "80\0\0\v\0\0\004\0\0\0\0", 12) .......................................................................................................... = 12
read(4, "r o o t : T V x 9 c 4 l P H M C ".., 8192) .............................................................................................. = 1116
read(4, "# # # # # # # # # # # # # # # # ".., 8192) .............................................................................................. = 319
read(3, "m s g c a t 0 1 \0\0\0D \001\001".., 1212) .............................................................................................. = 1212
read(3, "U I D ", 3) ............................................................................................................................. = 3
read(3, "m s g c a t 0 1 \0\0\0D \001\001".., 1212) .............................................................................................. = 1212
read(3, "P I D ", 3) ............................................................................................................................. = 3
read(3, "m s g c a t 0 1 \0\0\0D \001\001".., 1212) .............................................................................................. = 1212
read(3, "P P I D ", 4) ........................................................................................................................... = 4
read(3, "m s g c a t 0 1 \0\0\0D \001\001".., 1212) .............................................................................................. = 1212
read(3, "C ", 1) ................................................................................................................................. = 1
read(3, "m s g c a t 0 1 \0\0\0D \001\001".., 1212) .............................................................................................. = 1212
read(3, "S T I M E ", 5) ......................................................................................................................... = 5
read(3, "m s g c a t 0 1 \0\0\0D \001\001".., 1212) .............................................................................................. = 1212
read(3, "T T Y ", 3) ............................................................................................................................. = 3
read(3, "m s g c a t 0 1 \0\0\0D \001\001".., 1212) .............................................................................................. = 1212
read(3, "T I M E ", 4) ........................................................................................................................... = 4
read(3, "m s g c a t 0 1 \0\0\0D \001\001".., 1212) .............................................................................................. = 1212
read(3, "C O M M A N D ", 7) ..................................................................................................................... = 7
read(4, "r o o t : T V x 9 c 4 l P H M C ".., 8192) .............................................................................................. = 1116
read(5, 0x7f617b00, 4) ........................................................................................................................... = 0
read(3, " U I D P I D ".., 8192) .............................................................................................. = 164
read(3, 0x40278070, 8192) ........................................................................................................................ = 0
read(3, "02\v010e0512@ \0L 0fO fd\0\0\0\0".., 128) ............................................................................................... = 128
read(3, "10\0\004\0\0\0( \003H \ \0\0\0\0".., 48) ................................................................................................ = 48
read(3, "0214010e0512@ \0\0\0\0\0\0\0\0\0".., 128) ............................................................................................... = 128
read(3, "10\0\004\0\0\0( \016e304\0\010\0".., 48) ................................................................................................ = 48
This is just first few line. There many like this.
How do I get the filename from this?
I am using HP-UX .
Please do help.