Tuesday, 20 May 2014

Alternative to lsof and fuser

We recently had some mysterious run-away process(es) that trashed a NFS fileserver. Firstly, the offending client machine got blocked off so that others could still use the fileserver. We then had to find out which process was causing the damage. Unfortunately both lsof and fuser didn't work as they were blocked - presumably because of the firewalled fileserver. After some googling I found a need solution that pokes the /proc filesystem directly:

find /proc/ -type l -printf "%p -> %l/\n" 2>/dev/null | \
   grep " -> $FILE_PATH_TO_CHECK"|cut -d/ -f3|sort -u

This will spit out a list of PIDs which can then be further checked using for example

ps -p $PID -f