lsof

Lsof ( list open files ) has been developed by Vic Abell an open source tool that displays on Unix systems, which programs keep which files or sockets open. The current version is 4.86 dated 10 April 2012. Lsof is under a format compatible with the BSD License license.

Lsof works according to its manpage on the following operating systems: AIX 5.3, 9 Darwin (Mac OS X 10.5), FreeBSD 4.9 ( x86), FreeBSD 7 ( amd64 ), Linux 1.2.72 (x86, amd64 ), Solaris 9 and 10

Output format

Open files with lsof

• UNIX domain sockets ( type = unix )
• Regular files ( type = REG)
• FIFOs ( type = FIFO)
• Open directories ( type = DIR)
• Internet domain sockets ( type = type = IPv4 or IPv6)

And a few dozen others, such as AX.25 sockets, block devices, etc.

The output looks like this:

COMMAND PID USER FD TYPE DEVICE SIZE TID / NODE NAME OFF ... ssh-agent 2678 lbo 3u unix 0xffff88013e71cac0 0t0 7624 / tmp/ssh-oyerzGJI2633/agent.2633 ssh-agent 2678 lbo 6w FIFO 0,8 0t0 4795 pipe ssh-agent 2678 lbo 8r FIFO 0,8 0t0 4799 pipe system -co 2866 lbo mem REG 8,6 162968 1050015 / usr/lib/x86_64-linux-gnu/libssh2.so.1.0.1 sshd 3031 root cwd DIR 8,6 4096 2 / sshd 3031 root rtd DIR 8,6 4096 2 / sshd 3031 root txt REG 8,6 517088 1053360 / usr / sbin / sshd sshd 3031 root mem REG 8,6 131107 1187879 / lib/x86_64-linux-gnu/libpthread-2.13.so sshd 3031 root mem REG 8,6 80712 1180726 / lib/x86_64-linux-gnu/libresolv-2.13.so sshd 3031 root 0u CHR 1,3 0t0 1028 / dev / null sshd 3031 root 3u IPv4 8026 0t0 TCP *: ospfapi (LISTEN ) sshd 3031 root 4u IPv6 8028 0t0 TCP *: ospfapi (LISTEN ) ssh 7314 lbo cwd DIR 8,7 4096 5767169 / home / lbo ssh 8602 lbo 3r IPv6 68343 0t0 TCP [ 2001:470:1 F0B: 2f2: 3189:67 c1: b550: 9,400 ]: 56194 -> obsd - lbo6: ssh ( ESTABLISHED ) ... udevd 3226 root 11u netlink 0t0 10784 KOBJECT_UEVENT ... Here you can see very well the different types ( TYPE column ), here primarily on the basis of the sshd and ssh client.

Output format to other programs

For processing the output with scripts can be generated with the-F option, an alternative output format, where each line an identifying letter followed by the corresponding value is available. For each running process, a multi-line section is created that is initiated. Due to the line with the letter p and the process ID Within a process section, values ​​are as the user ID of the process, initiated by u, also several sections on the open files, preceded by a line with the letter f and the file descriptor. An exemplary output for the process sshd with two file sections then would look like this:

... p5502 g5502 R1 csshd u0 Lroot fcwd a l TDIR D0x811 S4096 i2 k25 n / FTXT a l Treg D0x811 s540896 i657919 k1 n / usr / sbin / sshd ... Use this output format, for example, of some scripts that are included with lsof.

Everyday benefits

Very often used lsof when the Unix command umount refuses to unmount a device, if there are open files on this device or in its mount directory ( the # represents a root shell ):

# Umount / mount / path umount: / mount / path: device is busy. By lsof and grep can now easily determine which programs need to be completed to ensure a successful unmount:

# Lsof | grep ' / mount / path ' bash 3156 usr cwd DIR 8,33 4096 2 / mount / path From the found entry can be inferred that the user usr has run a bash shell with PID 3156, the / mount / path as working directory (Current Working Directory ) uses, recognizable by the type DIR.

The mount version of the util - linux package are pointing to even lsof:

# Umount / mount / path umount: / mount / path: device is busy.         ( In some cases useful info about processes did use the device is found by lsof ( 8) or fuser (1)) Web Links

• Homepage Developer