From: Adams Kevin J (kevin.adams@PHS.COM)
Date: Fri Aug 23 2002 - 13:38:48 EDT
Simon,
I believe that you and Sunder are correct based on the following:
# ls -l /|grep ^d|wc -l
27
# istat /
Inode 2 on device 10/4 Directory
Protection: rwxr-xr-x
Owner: 0(root) Group: 0(system)
Link count: 29 Length 1536 bytes
However, I'm very confused that Tripwire did not report a new directory or
something.
I assume that you add 2 for "." and "..".
I did rename a directory mount point, but would not expect that to make the
difference.
Thanks,
Kevin
-----Original Message-----
From: Green, Simon [mailto:SGreen@KRAFTEUROPE.COM]
Sent: Friday, August 23, 2002 3:30 AM
To: aix-l@Princeton.EDU
Subject: Re: [aix-l] How to determine what the links to / are
I do not believe that there is any explicit way of telling what the links
are; the filesystem structure doesn't contain that information.
As Sunder said, the links probably represent subdirectories, (which may or
may not be mount points for other filesystems). Count the number of
directories and add two.
That should be everything, since it's not possible to hardlink a directory,
and symbolic links don't affect the link count.
If it had been a file, you could use find. For example, to find everything
linked to /usr/bin/ksh:
ls -i /usr/bin/ksh
This gives me an inode of 80745 on my system.
find /usr -inum 80745 -ls -xdev
80745 240 -r-xr-xr-x 4 bin bin 243374 Mar 7 2001
/usr/bin/ksh
80745 240 -r-xr-xr-x 4 bin bin 243374 Mar 7 2001 /usr/bin/sh
80745 240 -r-xr-xr-x 4 bin bin 243374 Mar 7 2001
/usr/bin/psh
80745 240 -r-xr-xr-x 4 bin bin 243374 Mar 7 2001
/usr/bin/tsh
Note that this doesn't show /bin/ksh, since that only exists due to the
symbolic link from /bin to /usr/bin.
Simon Green
Philip Morris ITSC Europe
AIX-L Archive at http://marc.theaimsgroup.com/?l=aix-l&r=1&w=2
AIX FAQ at http://www.faqs.org/faqs/aix-faq/
N.B. Unsolicited email from vendors will seldom be appreciated.
> -----Original Message-----
> From: Adams Kevin J [mailto:kevin.adams@PHS.COM]
> Sent: 22 August 2002 22:11
> To: aix-l@Princeton.EDU
> Subject: How to determine what the links to / are
>
>
> The other day Tripwire told me the number of links to / had
> changed from 30
> to 31:
>
> changed: drwxr-xr-x root 1536 Aug 17 02:01:20 2002 /
>
> ### Phase 5: Generating observed/expected pairs for changed files
> ###
> ### Attr Observed (what it is) Expected (what
> it should be)
> ### =========== =============================
> =============================
> /
> st_nlink: 31 30
>
>
> To verify this I ran istat as follows:
>
> # istat /
> Inode 2 on device 10/4 Directory
> Protection: rwxr-xr-x
> Owner: 0(root) Group: 0(system)
> Link count: 31 Length 1536 bytes
>
> Last updated: Thu Aug 22 02:01:24 2002
> Last modified: Thu Aug 22 02:01:24 2002
> Last accessed: Thu Aug 22 12:02:40 2002
>
>
> How can I tell what the links are?
>
>
> Kevin Adams
>
>
> This electronic message transmission, including any
> attachments, contains information from PacifiCare Health
> Systems Inc. which may be confidential or privileged. The
> information is intended to be for the use of the individual
> or entity named above. If you are not the intended recipient,
> be aware that any disclosure, copying, distribution or use of
> the contents of this information is prohibited.
>
> If you have received this electronic transmission in error,
> please notify the sender immediately by a "reply to sender
> only" message and destroy all electronic and hard copies of
> the communication, including attachments.
>
This electronic message transmission, including any attachments, contains information from PacifiCare Health Systems Inc. which may be confidential or privileged. The information is intended to be for the use of the individual or entity named above. If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited.
If you have received this electronic transmission in error, please notify the sender immediately by a "reply to sender only" message and destroy all electronic and hard copies of the communication, including attachments.
This archive was generated by hypermail 2.1.7 : Wed Apr 09 2008 - 22:16:10 EDT