Linux Common Command Notes (i)--lsof

The use of lsof

Lsof Full Name list opened files, which is the file that has been opened in the system. In a Linux environment, everything is a file, a device is a file, a directory is a file, and even a sockets is a file. So, with the good lsof command, it is very helpful for the daily Linux management.

Lsof is one of the most commonly used commands for Linux, and the usual output format is:
#lsof +d/usr/local/
#lsof-I: 22 know what program 22 ports are running now
Wait a minute
View the appropriate usage to see the man help find corresponding options: Man lsof

Several fields are common:

1, command default to 9 characters in length display the name of the commands. The width of the display can be specified using the +c parameter, and the full name of the command (-c) is displayed if the parameter followed by +c is zero.

2, the PID process ID number (-p)

3. TID if it is a thread, display the thread ID

4, the user command execution UID or the system login name. (-u)

5. FD is the file descriptor, FileName descriptor number (-D)

6. Type

7, device use character special, block special The equipment number indicated

8, the size of the Size/off file, if not in size, will be left blank.

9. Inode ID of NODE local file

10, Mount point and the full path of the file (link will be resolved to the actual path), or connect the two sides of the address and port, status, etc.

Use the sample:

Lsof Urfile shows which program the file (Ufile) was called

Lsof-c SYSTEMD shows which files are used by the SYSTEMD process

Lsof-p PID uses PID to show which files the process uses

lsof-i:22 shows which IP 22 ports are used

Lsof +d/root Show file opened under root, not recursive

Lsof +d/root Ibid., recursive

Lsof-u Username Show user-opened files

Other uses of lsof

1. Using lsof can also restore some of the previously deleted files (the in-memory process is still in)

For detailed operation, please visit: 51248761

Lsof the principle of recovering deleted content is still the recovery of a process that remains in memory after deletion. This needs to be traced back to the Linux storage mechanism. This method of recovering deleted files is useful for many applications, especially log files and databases.

Storage mechanism and storage structure of Linux files:

        一个文件在文件系统中的存放分为两个部分：数据部分和指针部分，指针位于文件系统的meta-data中，数据被删除后，这个指针就从meta-data中清除了，而数据部分存储在磁盘中，数据对应的指针从meta-data中清除后，文件数据部分占用的空间就可以被覆盖并写入新的内容，之所以出现删除abc.txt文件后，空间还没释放，就是因为python进程还在一直向这个文件写入内容，导致虽然删除了abc.txt文件，但文件对应的指针部分由于进程锁定，并未从meta-data中清除，而由于指针并未被删除，那么系统内核就认为文件并未被删除，因此通过df命令查询空间并未释放。                在文件系统处理文件需要的信息都存放在索引节点(inode)中，如果在删除文件的时候索引节点的引用计数不为0（表示文件正在被使用），则不会在磁盘中真正的删除文件，从而保证正在使用此文件的进程能够正常的处理文件。      首先我们一起来看一下内核中关于文件系统的一些关键数据结构的关联，当一个进程打开一个文件后，便会在内核中创建一个file对象，这个对象主要描述了进程如何与文件进行交互。file对象中将指向一个dentry结构（目录项），目录项中描述了目录项名称，父目录项信息，子目录项信息等。而dentry中的d_inode所指向的inode节点中则包含了实际的文件存储在磁盘上的信息。       当多个进程打开同一个文件时，内核中变会创建相应的file对象，但是他们都公用同一个dentry，只不过每一次打开文件dentry的引用计数d_count加1。并且对于打开的同一个文件而言，inode也是唯一的，inode的引用计数i_count一般为文件硬链接的数目。     Linux系统内部不使用文件名，而使用inode号码来识别文件。对于系统来说，文件名只是inode号码便于识别的别称或者绰号。表面上，用户通过文件名，打开文件。实际上，系统内部这个过程分成三步：首先，系统找到这个文件名对应的inode号码；其次，通过inode号码，获取inode信息；最后，根据inode信息，找到文件数据所在的block，读出数据。

Linux Common Command Notes (i)--lsof