Where does the inode table reside ?? And how can i check the inode entries ?
I want to check the entries of inode table corrosponding to the inode no. that i got from the fuser command.
fuser -uV /clocal/mqbrkrs/user/mqsiadm/sanjay
/clocal/mqbrkrs/user/mqsiadm/sanjay:
inode 569506c(t9154r0)
inode 577710c(mqsiadm)
inode 1044732c(mqsiadm)
inode 1155126c(mqsiadm)
Please help !!
ASAP !!
The location of the inode table in a file system depends on the particular file system being used. In general, most modern file systems scatter the inodes among the data blocks. This allows an inode to reside close to the data it describes and tends to reduce overall seek time. You don't say what type of check you want to perform. Most file systems include a version of fsck and this program should be able to verify the integrity of the inode table. You need to unmount the file system first and this usually requires single user mode.
If you want to find inode-to-filename mappings, "ls -li" is a tool that comes to mind. You can find all hard links to an inode with a command like:
find /mountpoint -inum 123456 -print
But be aware that it is legal for a file described by an inode to have zero hard links. (Such a file will disappear when the last program that has it open closes it.)
Hey,
Whats the mountpoint there ?? Is it the name of the directory ??
I got the another point that in ls -li, 'i' shows the inode no. of the file. But then could you please tell me what the fuser -uV Filename1 gives. (As i have shown above). As i compared the inode no. got from ls -li and fuser command, and the nos. where different.
One more thing fuser command is working on directory but not on the file, dont know why ??
fuser -uV /clocal/mqbrkrs/user/mqsiadm/sanjay
/clocal/mqbrkrs/user/mqsiadm/sanjay:
inode 569506c(t9154r0)
inode 577710c(mqsiadm)
inode 1044732c(mqsiadm)
inode 1155126c(mqsiadm)
In the above command "sanjay" is directory, in which there are no. of files which has been recently accessed by someone, whoes ids are listed in the braces () with inode no.
Now here is the catch :
Please give me some solution to this problem as I am after this since last week.
Thanks !!
The mountpoint is where the filesystem gets mounted. Run a command like "df -k" which should give you a list of filesystems. Each line will have a directory which is the mountpoint. If the inode numbers do not match, you have the wrong files. Use that find command to locate the file which matches a particular inode number.
You don't say what os you are using. My fuser does not have -V and it does not display inode numbers. To get more info on your fuser, use the command "man fuser" and read the man page. My fuser man page says stuff like "c file is its current directory". The output you show has c on the lines, it looks like you may be dealing with current directories. But I would expect pid's rather that inode numbers. Your fuser is not like mine and you have provided so few details that I really cannot help you here.
The current directory is controlled by the cd command in the shell. If I type "cd /local/local/bin", then /usr/local/bin becomes my current directory and fuser would show the inode of /usr/local/bin in the output.
Hey,
I am using AIX5.2.
And in "man fuser", it has -V and -c options.
fuser [ -c | -d | -f ] [ -k ] [ -u ] [ -x ] [ -V ]File ...
The fuser command lists the process numbers of local processes that use the local or remote files specified by the File parameter. For block special
devices, the command lists the processes that use any file on that device.
Each process number is followed by a letter indicating how the process uses the file:
c Uses the file as the current directory.
e Uses the file as a program's executable object.
r Uses the file as the root directory.
s Uses the file as a shared library (or other loadable object).
Flags
-V Provides verbose output.
-c Reports on any open files in the file system containing File.
-u Provides the login name for local processes in parentheses after the process number.
-f Reports on open instances of File only.
-x Used in conjunction with -c or -f, reports on executable and loadable objects in addition to the standard fuser output.
As I have said, i am using command (given below)
fuser -uV /clocal/mqbrkrs/user/mqsiadm/sanjay
And it shows the o/p (given below)
/clocal/mqbrkrs/user/mqsiadm/sanjay:
inode 569506c(t9154r0)
inode 577710c(mqsiadm)
inode 1044732c(mqsiadm)
inode 1155126c(mqsiadm)
Now, for example 569506 is the process no. that uses a file in the current directory (c). Now how would I map the name of the file in the current directory, which is used by the process whose process id is 569506 ?? In simple terms I want the name of the file which is being used !!
Hope you get this !!
Can we map process no. in "ps" table ?? From there i would get the name of the file or not corrosponding to that process no. which i have got from fuser command??
Any light on this ???
The only program I know that can do that is lsof which is a public domain utility. I'm not sure where to get a copy for AIX though. Once you have lsof, you can use:
lsof -p 569506
Hey,
As i am using AIX5.2 version., still i am not able to run the lsof command.
It says
ksh: lsof: not found.
Means in the korn shell, i am not able to get the reference of lsof command.
Couldn't run that !!
Whats up now ?
Hey,
I want to ask a simple Question....
How would I be able to come to know that files/directoires in a Parent directory has been accessed (means contents of the file has been just viewed) by the user(s) in a group ? and mail the name(s) of those files/directories which has been accessed recently in past 1 or 2 minutes with the name of the user who viewed the files/direcotries.
Please answer this QUESTION asap as I am after this problem for past 15 days and I did't get any perfect answer.
Please Help !!
Thanks !!
Well, as for your first question, I'm not surprised that you don't have lsof, it is not standard. I do not know of a version for AIX.
As for your 2nd question, Unix does not maintain a list of users who accessed stuff. You can tell that that some process accessed a file because atime will generally change. See my article, mtime, ctime, and atime for more info on that.
Maybe you can consider another OS. HP-UX can be converted into a trusted system and then full auditing can be turned on. Auditing records every system call. This requires a lot of disk space and is a heavy performance hit. But you can then inspect the logs to see who accessed which file. I believe that Solaris has something similiar, but I have not used it. And you can get lsof for both Solaris and HP-UX from the freeware sites. There may be auditing features available for AIX and there may be some way to get lsof for AIX, but I don't know AIX very well. Maybe some AIX expert can add some more info.
Hey Thanks buddy and Please let me know once you'll find out the solution to this problem !! I'll try to look into "lsof" .
I have seen your article already, thats fine !!
Thanks a lot buddy !!
Keep looking, if you'll get some clue anyways !!