Suren's Weblog

« The real story behin... | Main | Cable, Blu-ray, and... »

Saturday Jan 07, 2006

Nifty Unix tools

Unix has always been rich in tools with the philosophy of "one tool
for one thing". Many of them work best when used in combination with
others. While there are dozens of very complex tools to do equally
complex tasks, there are some smaller but very useful ones.

I find the combination of 'more' and 'grep' most valuable in daily
usage. Does anyone agree? 'more filename | grep string' is something we
use almost everyday.

 Some tools are not as visible in normal use. 'ncheck' is one tool I
came to know about much later in my Unix usage. An example:

 To get info about a file like its permissions, owner, size, etc. we
just use ls -l. Let's get some info about vi file that we know resides
in /usr/bin/

bash-3.00# ls -l /usr/bin/vi
-r-xr-xr-x 5 root bin 194404 Jan 23 2005 /usr/bin/vi

So the file actually has 5 hard links.
What are the other 4 files that link to it?

Let's ls with -i option to get its inode number.

bash-3.00# ls -li /usr/bin/vi 
89215 -r-xr-xr-x 5 root bin 194404 Jan 23 2005 /usr/bin/vi

So its inode number is 89215.

How to get the other four links now that we have the inode number i.e.
find all files pointing to this inode. This seems a tough one but
another tool 'ncheck' comes to the rescue. 'ncheck' is slow but does
its work. For our example:

bash-3.00# ncheck -i 89215
/dev/dsk/c1d0s0:
89215 /usr/bin/edit
89215 /usr/bin/ex
89215 /usr/bin/vedit
89215 /usr/bin/vi
89215 /usr/bin/view

So we found all the hard links to vi using simple commands.
Pretty cool, these tools are!

Posted at 04:47AM Jan 07, 2006 by surenssamant in Sun | Comments[4] | Permalink

Comments:

Actually, "more filename |grep string" is something you really shouldn't use:
- It forces you to type more (Unix is for lazy people)
- It is really slow (2 times slower than grep string filename
But, yes, philosophy aside, more, grep (and awk) are 3 of the tools I use the most.
Somehow, I don't remember ever using ncheck. son't know why, it can be quite usefull but, I simply never remember it (Human beings are really habit creatures)

Posted by Jaime Cardoso on January 07, 2006 at 07:02 AM IST #

ncheck is a ufs specific command and requires that you have permission to open the raw device, then it also can be fooled by the buffer cache and therefore should only be used on unmounted file systems.

: sigma IA 3 $; find / -xdev -inum 307 -ls 2> /dev/null
  307  224 -r-xr-xr-x   5 root     bin        220904 Nov 10 02:24 /usr/bin/edit
  307  224 -r-xr-xr-x   5 root     bin        220904 Nov 10 02:24 /usr/bin/ex
  307  224 -r-xr-xr-x   5 root     bin        220904 Nov 10 02:24 /usr/bin/vedit  307  224 -r-xr-xr-x   5 root     bin        220904 Nov 10 02:24 /usr/bin/vi
  307  224 -r-xr-xr-x   5 root     bin        220904 Nov 10 02:24 /usr/bin/view

also if you like more, then you will like less even more.

Posted by Chris Gerhard on January 07, 2006 at 06:05 PM IST #

ncheck is NOT ufs specific. SCO Unix also had ncheck!!

Posted by Dave on January 08, 2006 at 08:49 AM IST #

In response to the comments, I'd say: We learn new things each day, but Old habits die hard. Seems like I'm only repeating Jaime. The old habit is the only thing preventing me from using less instead of more. Chris, that seems to be actually faster than ncheck though find usually tends to be slower. :-)