On Thu, Jan 30, 2025 at 07:48:17AM +0000, Colin Paice wrote: > Looking at the SMF START 92-11 for individual Unix files, I'm seeing 100s > of records like pathname /tmp/shbdFEgaeEA reads=0 write=0 directory reads 8. > > What is going on ? what does dir reads> 0 but no reads act mean? > what is using this file - and can we stop it(grin)
If you want to confirm a suspicion (e.g. RACF as somebody else mentioned) and you know the PID of that process, you can try lsof[1] or `fuser`, though mind that the access might only be brief, so it might be difficult to catch it. It seems like z/OS UNIX supports inotify[2], which might be a good way to figure out which process(es) access a particular file. inotify-tools[3] are the weapons of choice here. in particular `inotifywatch` and `inotifywait`. -Alex [1] https://github.com/lsof-org/lsof [2] https://www.ibm.com/docs/en/zos/3.1.0?topic=lf-inotify-add-watch-add-watch-initialized-inotify-instance [3] https://github.com/inotify-tools/inotify-tools/wiki ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
