Just for the record, I think *my* (not the OP's) problem when trying to grep fstat results was that unlike lsof, fstat didn't show the former file names (hence unlinked); it only showed inodes, so I never got the "find this former file" part to work on OpenBSD. I have since found this blog post, where your man seems to have had the same problem, and where he had written a script with ncheck_ffs(8) to hack his way around that. That's a 13 year-old post though, and I haven't tried it: http://geek00l.blogspot.com/2006/03/openbsd-fstat-vs-lsof.html There used to be an OpenBSD lsof port, as per what's listed on ports.su, but there's no amd64 package now, and I never got that port to work either. Still, if someone were determined and actually competent, maybe some of this info could help in similar situations.
Ian On 08/07/2019, Todd C. Miller <todd.mil...@sudo.ws> wrote: > On Mon, 08 Jul 2019 15:59:54 -0400, Allan Streib wrote: > >> It does behave like the file is opened and then unlinked. Sorry for my >> term "ghost" file I couldn't quite find the right words for what I was >> seeing. > > You can use the fstat command to find these files (even if unlinked) > as well as the ID of the process that has them open. For example: > > fstat -f /tmp > > - todd >
