17.22 Finding the Links to a File

Here is how to find links - and a brief look at the UNIX filesystem from the user's viewpoint. Suppose you are given the following:

% ls -li /usr/foo
 2076 -rw-r--r--  3 chris         326 Sep 16 03:23 /usr/foo

In other words, there are three links, and /usr/foo is one of three names for inode (1.22) 2076. You can find the full names of the other two links by using /etc/ncheck and/or find. However, just knowing the inode number does not tell you everything.

The whole truth is that there is another number hiding away in there. This is the device number, and it tells which filesystem holds the file. There can be any number of inode 2076s, as long as each one is on a different filesystem. (More recent UNIX systems use a filesystem ID number in place of a device number, so that they can represent filesystems on other machines. They may also use a vnode number rather than an inode number. The effect is the same, although you often cannot run /etc/ncheck on anything but a local disk.)

You can find out which filesystem /usr/foo is in by running df (24.9) or mount. Suppose it is on /dev/sd0g. If /dev/sd0g shows up as:

% df
Filesystem    kbytes    used   avail capacity  Mounted on
/dev/sd0g     179423  152202    9278    94%    /usr

% ls -l /dev/sd0g
brw------  1 root       2,   6 Dec 27 07:17 /dev/sd0g

then it is "major device 2, minor device 6." These numbers are smashed together with the makedev macro in one of the kernel source files. Typically this is just major*256 + minor; here we have 2*256+6, or 518. Another way to find this same number is to use the stat(2) system call on the original file /usr/foo; the device number appears in the st_dev field. [The stat (21.13) program does this for you. -JP ]

So if you do a find / -inum 2076 -print to find every file with inode number 2076, you may find more than three files. Only three of them will be on sd0g, though.