Basic lsof usage

When you want to start a service on your computer and the computer prompts "port already in use", you can run the lsof command to check that the process occupies this port (lsof-I: port ). lsof is short for LiSt Open Files. In linux, everything exists in the form of a file. Through a file, you can not only access conventional data, but also access network connections and hardware.

The use of lsof is as follows:

qsun@qsun-VirtualBox:~$ sudo lsof | head -5[sudo] password for qsun: lsof: WARNING: can't stat() fuse.gvfs-fuse-daemon file system /home/qsun/.gvfs      Output information may be incomplete.COMMAND    PID       USER   FD      TYPE     DEVICE  SIZE/OFF       NODE NAMEinit         1       root  cwd       DIR        8,1      4096          2 /init         1       root  rtd       DIR        8,1      4096          2 /init         1       root  txt       REG        8,1    194528        172 /sbin/initinit         1       root  mem       REG        8,1     47040     132308 /lib/i386-linux-gnu/libnss_files-2.15.so

The significance of lsof output column information is as follows:

COMMAND: process name PID: process identifier

USER: process owner

FD: file descriptor. The application identifies the file through the file descriptor. Types such as cwd and txt: file TYPE, such as DIR and REG

DEVICE: Specify the disk name.

SIZE: File SIZE

NODE: Index NODE (the identifier of the file on the disk)

NAME: the exact NAME of the opened file.

The file descriptor cwd value in the FD column indicates the current working directory of the application, which is the directory started by the application. Unless it changes the directory itself, the txt file is the program code, for example, the application binary file itself or the shared library, as shown in the/sbin/init program shown in the above list.

The second value indicates the file descriptor of the application, which is an integer returned when the file is opened. The last line of the above file/dev/initctl, whose file descriptor is 10. U indicates that the file is opened and in read/write mode, instead of read-only or write-only (w) mode. In addition, W indicates that the application has a write lock on the entire file. This file descriptor is used to ensure that only one application instance can be opened at a time. Each initial application has three file descriptors, ranging from 0 to 2, indicating standard input, output, and error streams. Therefore, the FD of files opened by most applications starts from 3.

The Type column is more intuitive than the FD column. The files and directories are called REG and DIR respectively. CHR and BLK, respectively, indicate characters and Block devices; or UNIX, FIFO, and IPv4, respectively indicate UNIX domain sockets, first-in-first-out (FIFO) queues, and Internet Protocol (IP) sockets.

The syntax format of lsof is:
Lsof [options] filename

Lsof abc.txt displays the process of opening the abc.txt file lsof-c abc displays the file currently opened by command abc (c is the abbreviation of command) lsof-g gid: displays the processes belonging to the gid. lsof + d/usr/local/displays the files opened by the process in the directory lsof + D/usr/local, however, the system searches for directories in the directory, long time lsof-d 4 display process lsof-I with fd 4 is used to display process conditions that meet the conditions lsof-I [46] [protocol] [@ hostname | hostaddr] [: service | port] 46 --> IPv4 or IPv6 protocol --> TCP or UDP hostname --> Internet host name hostaddr --> IPv4 address service -->/etc/service name (can be more one) port --> port number (more than one)

Use instance

Lsof 'which httpd '// The process is using the apache Executable File lsof/etc/passwd // The process is occupying/etc/passwdlsof/dev/hda6 // The process is in occupy hda6lsof/dev/cdrom // The process occupies the optical drive lsof-c sendmail // view the File Usage of the sendmail process lsof-c courier-u ^ zahn // display the files opened by courier headers, but it does not belong to the user zahnlsof-p 30297 // display the processes whose files are opened by pid 30297. lsof-D/tmp displays all the instances and files opened in the/tmp folder. However, the symbol file is not listed in the lsof-u1000 // view the File Usage of the user's process whose uid is 100 lsof-utony // view the File Usage of the user's tony process lsof-u ^ tony // check the file usage of the process that is not the user tony (^ indicates the inverse) lsof-I // display all opened ports lsof-I: 80 // display all processes that open port 80 lsof-I-U // display all opened ports and UNIX domain file lsof-I UDP @ [url] www.akadia.com: 123 // display the link lsof-I tcp@ohaha.ks.edu.tw for processes that opened UDP 123 (ntp) ports to www.akadia.com: ftp-r // constantly check the current ftp connection status (-r and lsof will be executed forever until the interruption signal is received, and + r and lsof will be executed continuously, until no file is displayed, the default is 15 s refresh) lsof-I tcp@ohaha.ks.edu.tw: ftp-n // lsof-n does not convert IP to hostname, the default is not added with the-n Parameter

Reference: http://www.cnblogs.com/ggjucheng/archive/2012/01/08/2316599.html