获取写文件的进程号
安装sysemtap
yum -y install systemtap
SystemTap 是对 Linux 内核监控和跟踪的工具
利用systemtap中的inodewatch.stp工具来查找写文件的进程号
得到文件的inode
stat -c '%i' /tmp/iostat_2019-03-13
4210339获取文件所在设备的major，minor
ls -al /dev/vda1
brw-rw---- 1 root disk 253, 1 Jan 30 13:57 /dev/vda1得到写文件的pid
stap /usr/share/systemtap/examples/io/inodewatch.stp 253 1 4210339
Checking "/lib/modules/3.10.0-862.14.4.el7.x86_64/build/.config" failed with error: No such file or directory
Incorrect version or missing kernel-devel package, use: yum install kernel-devel-3.10.0-862.14.4.el7.x86_64根据系统内核版本在kernel-devel rpm build for : Scientific Linux 7网站上下载相应的kernal-devel包
wget ftp://ftp.pbone.net/mirror/ftp.scientificlinux.org/linux/scientific/7.2/x86_64/updates/security/kernel-devel-3.10.0-862.14.4.el7.x86_64.rpm
rpm -ivh kernel-devel-3.10.0-862.14.4.el7.x86_64.rpm再次执行stap
stap /usr/share/systemtap/examples/io/inodewatch.stp 253 1 4210339
……
Missing separate debuginfos, use: debuginfo-install kernel-3.10.0-862.14.4.el7.x86_64
Pass 2: analysis failed. [man error::pass2]
Number of similar error messages suppressed: 2.
安装debuginfo kernal
debuginfo-install kernel-3.10.0-862.14.4.el7.x86_64
Verifying : kernel-debuginfo-common-x86_64-3.10.0-862.14.4.el7.x86_64 1/3
Verifying : yum-plugin-auto-update-debug-info-1.1.31-50.el7.noarch 2/3
Verifying : kernel-debuginfo-3.10.0-862.14.4.el7.x86_64 3/3
Installed:
kernel-debuginfo.x86_64 0:3.10.0-862.14.4.el7
yum-plugin-auto-update-debug-info.noarch 0:1.1.31-50.el7
Dependency Installed:
kernel-debuginfo-common-x86_64.x86_64 0:3.10.0-862.14.4.el7再次执行stap
stap /usr/share/systemtap/examples/io/inodewatch.stp 253 1 4210339
ERROR: module version mismatch (#1 SMP Tue Sep 25 14:32:52 CDT 2018 vs #1 SMP Wed Sep 26 15:12:11 UTC 2018), release 3.10.0-862.14.4.el7.x86_64
WARNING: /usr/bin/staprun exited with status: 1添加 -v查看详细报错
stap -v /usr/share/systemtap/examples/io/inodewatch.stp 253 1 4210339
Pass 1: parsed user script and 471 library scripts using 240276virt/41896res/3368shr/38600data kb, in 300usr/20sys/320real ms.
Pass 2: analyzed script: 2 probes, 12 functions, 8 embeds, 0 globals using 399436virt/196284res/4744shr/197760data kb, in 1540usr/560sys/2106real ms.
Pass 3: using cached /root/.systemtap/cache/f5/stap_f5c0cd780e8a2cac973c9e3ee69fba0c_7030.c
Pass 4: using cached /root/.systemtap/cache/f5/stap_f5c0cd780e8a2cac973c9e3ee69fba0c_7030.ko
Pass 5: starting run.
ERROR: module version mismatch (#1 SMP Tue Sep 25 14:32:52 CDT 2018 vs #1 SMP Wed Sep 26 15:12:11 UTC 2018), release 3.10.0-862.14.4.el7.x86_64
WARNING: /usr/bin/staprun exited with status: 1
Pass 5: run completed in 0usr/10sys/38real ms.
Pass 5: run failed. [man error::pass5]修改
vim /usr/src/kernels/3.10.0-862.14.4.el7.x86_64/include/generated/compile.h
#define UTS_VERSION "#1 SMP Tue Sep 25 14:32:52 CDT 2018"
改为
#define UTS_VERSION "#1 SMP Wed Sep 26 15:12:11 UTC 2018"
rm -rf /root/.systemtap/cache/f5/stap_f5c0cd780e8a2cac973c9e3ee69fba0c_7030*再次执行
stap /usr/share/systemtap/examples/io/inodewatch.stp 253 1 4210339
iostat(4671) vfs_write 0xfd00001/4210339
iostat(4671) vfs_write 0xfd00001/4210339
iostat(4671) vfs_write 0xfd00001/4210339
iostat(4671) vfs_write 0xfd00001/4210339
iostat(4671) vfs_write 0xfd00001/4210339
iostat(4671) vfs_write 0xfd00001/4210339
iostat(4671) vfs_write 0xfd00001/4210339
iostat(4671) vfs_write 0xfd00001/4210339
iostat(4671) vfs_write 0xfd00001/4210339
iostat(4671) vfs_write 0xfd00001/4210339
iostat(4677) vfs_write 0xfd00001/4210339
iostat(4677) vfs_write 0xfd00001/4210339
iostat(4677) vfs_write 0xfd00001/4210339
iostat(4677) vfs_write 0xfd00001/4210339
iostat(4677) vfs_write 0xfd00001/4210339
iostat(4677) vfs_write 0xfd00001/4210339
iostat(4677) vfs_write 0xfd00001/4210339
iostat(4677) vfs_write 0xfd00001/4210339
iostat(4677) vfs_write 0xfd00001/4210339
iostat(4677) vfs_write 0xfd00001/4210339
iostat(4683) vfs_write 0xfd00001/4210339
............可见已经得到了写/tmp/iostat_date +%F 文件的进程号，但进程号一直在打印出来，因为后台进程iostat -dx -m 的在while循环中的，每隔sleep 2s 后就会执行一次iostat 产生新的pid。
那要怎样才能让iostat -dx -m 停止写/tmp/iostat_date +%F 文件了？除了重启大法好 $_$
rm -rf 也不能终止后台的while iostat进程写文件，删除了文件后，while循环又会生成新的文件
rm -rf /tmp/iostat_2019-03-1*
stat /tmp/iostat_2019-03-1*
File: ‘/tmp/iostat_2019-03-13’
Size: 146700 Blocks: 512 IO Block: 4096 regular file
Device: fd01h/64769d Inode: 4210339 Links: 1
Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root)
Access: 2019-03-14 16:07:26.211888899 +0800
Modify: 2019-03-14 16:18:17.854019793 +0800
Change: 2019-03-14 16:18:17.854019793 +0800服务器租用托管，机房租用托管，主机租用托管，https://www.e1idc.com
