LSOF__ powerful system monitoring, diagnostic commands

Lsof means ' list open files ' It can list the information of various processes open file, centos6.4 in the default is not with Lsof this command. To use it first through yum-y install lsof installation.

650) this.width=650; "src=" Http://s3.51cto.com/wyfs02/M02/74/C6/wKiom1Yoo1TiammhAAGfqfA_ZY0412.jpg "title=" QQ picture 20151022165055.png "alt=" Wkiom1yoo1tiammhaagfqfa_zy0412.jpg "/>

Lsof default without any parameters, all files opened by all processes will be output. Of course, this is not what we need.

1.lsof file name | Device name: View files, which processes are used by the device

Lsof/usr/local/tomcat/conf/server.xml

650) this.width=650; "src=" Http://s3.51cto.com/wyfs02/M01/74/C6/wKiom1Yop6PikwXoAAC8hl7r-rM355.jpg "title=" QQ picture 20151022170922.png "alt=" Wkiom1yop6pikwxoaac8hl7r-rm355.jpg "/>

2. Files that are opened in a directory

Lsof +d/var/log

650) this.width=650; "src=" Http://s3.51cto.com/wyfs02/M01/74/C3/wKioL1YoqWqxaKAGAAG7rIBglMk770.jpg "title=" QQ picture 20151022171616.png "alt=" Wkiol1yoqwqxakagaag7ribglmk770.jpg "/>

3. Specify the process number to view the files opened by the process

Lsof-p 1612

650) this.width=650; "src=" Http://s3.51cto.com/wyfs02/M00/74/C3/wKioL1YoqmOwd0ZGAAMaMklPC60755.jpg "title=" QQ picture 20151022172004.png "alt=" Wkiol1yoqmowd0zgaamamklpc60755.jpg "/>

4. View all processes and files opened by the specified user

Lsof-u Root

650) this.width=650; "src=" Http://s3.51cto.com/wyfs02/M00/74/C4/wKioL1YorBiRl2ifAAD3sThePKM928.jpg "title=" QQ picture 20151022172724.png "alt=" Wkiol1yorbirl2ifaad3sthepkm928.jpg "/>

5. See what processes are in use on the specified port

Lsof-i:22

650) this.width=650; "src=" Http://s3.51cto.com/wyfs02/M01/74/C7/wKiom1YorFWAqYXEAAEamoKRvho046.jpg "title=" QQ picture 20151022172928.png "alt=" Wkiom1yorfwaqyxeaaeamokrvho046.jpg "/>

6. Example of all TCP, UDP connections

Lsof-i TCP

Lsof-i upd

650) this.width=650; "src=" Http://s3.51cto.com/wyfs02/M02/74/C7/wKiom1YorOXx17SeAAJJU3e_Vww162.jpg "title=" QQ picture 20151022173150.png "alt=" Wkiom1yoroxx17seaajju3e_vww162.jpg "/>

7. See which processes are in use in the specified network port

lsof [email protected]

650) this.width=650; "src=" Http://s3.51cto.com/wyfs02/M01/74/C4/wKioL1YorkCgBAwOAAC5VoTVKvU832.jpg "title=" QQ picture 20151022173654.png "alt=" Wkiol1yorkcgbawoaac5votvkvu832.jpg "/>

8. View files opened by the specified program

Lsof-c Java

650) this.width=650; "src=" Http://s3.51cto.com/wyfs02/M02/74/C4/wKioL1YorzWALLCOAAGOlI_fvv4065.jpg "title=" QQ picture 20151022174046.png "alt=" Wkiol1yorzwallcoaagoli_fvv4065.jpg "/>

9.lsof Combinatorial logic Query

-A and

-O or

^ Non-

Lsof-a-U mysql-c java

650) this.width=650; "src=" Http://s3.51cto.com/wyfs02/M02/74/C5/wKioL1YotAvCJRg-AABzqrtk7Yg680.jpg "title=" QQ picture 20151022180137.png "alt=" Wkiol1yotavcjrg-aabzqrtk7yg680.jpg "/>

Lsof-o-U mysql-c java

650) this.width=650; "src=" Http://s3.51cto.com/wyfs02/M00/74/C5/wKioL1YotECDDBh8AAH0aUyeNBk036.jpg "title=" QQ picture 20151022180230.png "alt=" Wkiol1yotecddbh8aah0auyenbk036.jpg "/>

Lsof-u ^root

10. A case of problem solving with lsof in the production environment

My friend told me some time ago that he had a server/dev/sda1 that directory was full, and then he cleared a batch of logs and stuff, and soon it was full. He used df-h to see the actual usage rate is 100%, the capacity 50G use 50G, and when he used du-sh/dev/sda1, use only 20 g, but do not write in the file.

Let him use Lsof-n | grep deleted, this command will take all the processes that have not freed the file handle. A friend, MongoDB log accounted for more than 20 g. Restart the MongoDB process, configure the log to a directory with large disk capacity, and then do a log scrolling problem resolution.

Why is the DF command so much different from the du command? This is related to the principle of their realization.

The du command sums up the file system usage capacity based on all directories in the specified file system, symbolic connections, and the number of blocks used by the file, and the file system records its own data such as I node, disk map, super block, etc. these data du commands are not counted. The du command is a user-level program that can only get part of the file system.

The DF command is the total number of blocks and the number of blocks used by the disk distribution graph. Get real file system data. Linux The following file is just a link to the Inode, and the Inode link contains all of the properties of the file, such as permissions and owners, when we delete a file, actually just delete the link to the inode, and do not delete the Inode content, the previously referenced process can also be referenced, These inode can be written to new content only if the link is completely removed.

This article is from the "left-handed" blog, make sure to keep this source http://mofeihu.blog.51cto.com/1825994/1705356

LSOF__ powerful system monitoring, diagnostic commands