With these techniques, administrators like you become much more efficient.

Every object on AIX is a file. So it makes sense to understand a bit more about the types of files, the file sizes, and the handy commands to locate them. Each file has an inode, and the inode to a file contains information about ownership, permissions, file access times, plus other attributes relating to that particular file. In a nutshell, the inode holds all the information about the file. On AIX (or any UNIX/Linux system), there may be some files with the same inode number; however, they would reside on different file systems. The inode will be unique within that file system.

So how can we tell what inode is associated with a file? As usual, it's best explained with an example. Select any file by using this command:

ls -i <file-name>

$ ls -i smit.log

4311 smit.log

In the above output, the number 4311 is the inode number. Let's now further look at the file smit.log for its attributes, using the istat command, which will show more information about the inode:

$ istat /home/dxtans/smit.log

Inode 4311 on device 10/5       File

Protection: rw-r-----  

Owner: 203(dxtans)             Group: 1(staff)

Link count:   1         Length 5153 bytes

Last updated:   Wed Oct 17 19:38:55 BST 2012

Last modified: Wed Oct 17 19:38:55 BST 2012

Last accessed: Thu Aug 16 18:50:09 BST 2012

Looking at the above output, we can now tell that the inode is confirmed as 4311 (from our previous ls -i command). The file resides on device 10/5, which is the major and minor number of the special device file. To locate which device (logical volume) this major/minor number is associated with, change to the directory /dev, and then either use grep for the major/minor numbers or just page through a long listing to locate the file. Here's how to use grep to locate the listing:

$ cd /dev

$ ls -l |grep "10, 5"

brw-rw----   1 root     system       10, 5 Aug 16 18:57 hd1

crw-rw----   1 root     system       10, 5 Aug 16 18:57 rhd1

Here we have two devices, raw and physical. Using the physical device, list the logical volumes out from your volume group(s). To identify what file system hd1 resides on, by default hd1 will always be the /home file system. This is confirmed by looking at the logical volumes from rootvg and seeing which file system has hd1 as its device, which is /home:

$ lsvg -l rootvg

rootvg:

LV NAME             TYPE       LPs     PPs     PVs LV STATE     MOUNT POINT

hd5                 boot       1       1       1   closed/syncd N/A

hd6                 paging     8       8       1   open/syncd   N/A

hd8                 jfs2log   1       1       1   open/syncd   N/A

hd4                 jfs2       16     16     1   open/syncd   /

hd2                 jfs2       80     80     1   open/syncd   /usr

hd9var             jfs2       16     16     1   open/syncd   /var

hd3                 jfs2       3       3       1   open/syncd   /tmp

hd1                 jfs2       1       1       1   open/syncd   /home

…

…

Getting back to our istat output, the file smit.log is owned by user dxtans with a group membership of staff (the default AIX primary group), with the corresponding UID/GID (user id and group id). The file size is 5153 bytes or about 5 KB. The output also tells us the last update/access times on the file; this information is quite handy when you're investigating potential security violations.

We can also get the block information on where the file resides on the disk. Using the Logical Volume device and the inode number, we can use the istat command again to provide this information. The output contains the same information as the previous istat, but at the end it displays in hex the disk blocks where the file smit.log resides on the device on hd1.

# istat 4311 /dev/hd1

…

...

Block pointers (hexadecimal):

25ba

We can also use the file command to find the file type:

$ file smit.log

smit.log: commands text

The above command output informs us that the file contains command text, which means it is an ASCII readable file.

In the following example, we can see that the file stbackup is a binary file (executable or object):

$ file stbackup

stbackup: executable (RISC System/6000) or object module

Another useful command is ncheck, which is best run as the root user. Rather than give all the information about each individual file, it will display the inode number for each file it finds in a file system.

# ncheck

/dev/hd4:

14     /.bash_history

35     /.lsof_uk01wrs6008

15     /.profile

16     /.sh_history

17     /.ssh/.

37     /.stdefaults

22     /.topasrecrc/.

26     /.vi_history

32     /admin/.

27     /audit/.

28     /bin

…

…

We can also just parse in an inode number:

$ ncheck -i 4311

/dev/hd4:

/dev/hd1:

4311       /dxtans/smit.log

That's enough on the inodes. Let's now turn our attention to how to locate files and get the sizes of files or directories.

Locating Files

To locate a file or files, the ideal command to use is the find command; we can append shell commands to the command to do some form of action on the files found if required. To locate all files that end in: '.log', in the directory /upgrade, we could use this:

$ find /upgrade -name "*.log"

/upgrade/append.log

/upgrade/append1.log

/upgrade/append2.log

/upgrade/appenddv2.log

/upgrade/appenddv3.log

Alternatively, if we wanted to find all files in the directory /upgrade that contained only the pattern in the file named "appenddv," followed by ".log," we could use this:

$ find /upgrade -name "appenddv*.log"

/upgrade/appenddv2.log

/upgrade/appenddv3.log

A common usage for the find command is to find certain log or temp files that are older than n days. These types of commands would be run daily for housekeeping tasks. As a general rule, this command is used to identify files that may be candidates for truncation. The following example finds all files that start with "test" and end with ".log" and that are older than three days ( -mtime +3). It then uses the -exec option to do an ls listing, like so:

$ find . -name "test*.log" -type f -mtime +3 -exec ls {} \;

./aixmag/testme.log

./testdt.log

./testdt2.log

./testf.log

./testftpls.log

./testit.log

./trap/testit.log

./trap/testit2.log

We could change the ls command from the above command to a deletion and remove the files. However, be careful here: always run an "ls" before an "rm" so you know you're removing are the correct files.

$ find . -name "test*.log" -type f -mtime +3 -exec rm {} \;

To locate files that are greater than n size, we simply supply the size in bytes. For example, to locate all files on the system that are greater than 94371840 bytes (that's 90 MB), we could use the following code. Note the "c" at the end of the byte count; you need this so that "find" calculates the file size in bytes.

$ find / -size +94371840c        

/Downloads/AIXDR.tar

/upgrade/appos1

/upgrade/appos2

/upgrde/appos3

/upgrade/appos4

/upgrade/vipc2

/upgrade/vipc3

Getting File and Directory Sizes

Getting file or directory sizes is a common admin task. We are forever monitoring files that grow quickly!

Using the ls -s command with the s option will show the size in KB, like so:

$ ls -s vipc5

61440 vipc5

The above size in MB would be 60 MB.

When dealing with file sizes, I encourage you to use the du command and use either of the following units for its output:

• m for megabyte units
• g for gigabyte units

Let's now use the du command with some examples. The following two examples report the same file in GB and MB units, respectively:

$ du -gs appos3

0.11   appos3

$ du -ms appos3

110.00 appos3

If we need to see a list of files with their corresponding file size, we use a pattern match. The following will display file sizes in MB with files that start with "app*":

$ du -ms app*

100.00 appos1

100.00 appos2

110.00 appos3

120.00 appos4

90.00 appos5

Of course, we may want to see a total sum of the files matched. The following two commands achieve the same result. The first is run from the current directory; the other is run from the full directory to match files. Awk is used to provide a running total of the first column (size in MB). It then provides a total size of the matched files.

$ du -ms app*| awk '{sum+=$1} END {print sum}'

520

$ du -ms /upgrade/app*| awk '{sum+=$1} END {print sum}'

520

We can make the output more user-friendly:

$ du -ms /upgrade/app*| awk '{sum+=$1; print $1} END {print "total MB:" sum}'

100.00

100.00

110.00

120.00

90.00

total MB:520

To get the directory size and its contents, we simply supply the full path name:

$ du -ms /upgrade

990.03 /upgrade

Alternatively, we can supply the current path (a dot) as part of the du command:

$ cd /upgrade

$ pwd

/upgrade

$ du -ms .

990.03 .

Location and Size

Having the ability to locate certain files and get file or directory sizes means that, as an administrator, you are more efficient in your work.