Introduction and usage of LSOF commands in Linux

Because the application opens a list of file descriptors that provide a lot of information about the application itself, the ability to view this list through the Lsof tool can be very helpful for system monitoring and error scheduling.

Linux is all files, lsof (lists openfiles) is a tool that lists the current system open files. Files can be:

Normal file
Directory
Files on the network file system
Character or device file
(function) Shared library
Pipes, Named Pipes
Symbolic Links
Network files (for example: NFS file, network Socket,unix domain socket)
There are other types of files, and so on.

Lsof common parameters are as follows:
-a lists processes that open files exist
-c< Process name > List files opened by the specified process
-g List the GID number process details
-d< File Number > list the process that occupies the file number
+d< directory > List files that are opened under the directory
+d< directory > Recursive list of files opened under the directory
-n< directory > List files that use NFS
-i< conditions > Lists processes that meet the criteria. (4, 6, protocol,: Port, @ip)
-p< Process number > List files opened by the specified process number
-U list UID number process details

Lsof output Format:
MCKEE@MCKEE-PC ~/program/go/src/sharedlogic (release) $ sudo lsof | More
COMMAND PID TID USER FD TYPE DEVICE size/off NODE NAME
Init 1 root cwd DIR 8,3 4096 2/
Init 1 root RTD DIR 8,3 4096 2/
Init 1 root txt REG 8,3 265848 5767246/sbin/init
Init 1 root mem REG 8,3 47712 4985141/lib/x86_64-linux-gnu/libnss_files -2.19.so
Init 1 root mem REG 8,3 47760 4985151/lib/x86_64-linux-gnu/libnss_nis-2 .19.so
Init 1 root mem REG 8,3 97296 4985135/lib/x86_64-linux-gnu/libnsl-2.19. So
Init 1 root mem REG 8,3 39824 4985137/lib/x86_64-linux-gnu/libnss_compa T-2.19.so
Init 1 root mem REG 8,3 14664 4985082/lib/x86_64-linux-gnu/libdl-2.19.s O

Lsof output The column information description:
COMMAND: The name of the process
PID: Process Identifier
PPID: Parent Process identifier (needs to specify-R parameter)
USER: Process Owner
Pgid: The group to which the process belongs
FD: A file descriptor that the application recognizes by the file descriptor. such as CWD, TXT, etc.
Type: File types, such as Dir, Reg, and so on, common file types: dir: Represents the directory/CHR:/BLK: Block device type/unix:unix domain socket/FIFO: FIFO queue/ipv4: Internet Protocol (IP) sockets
DEVICE: Specifies the name of the disk
Size: Sizes of files
Node: Index node (identity of file on disk)
Name: Open the exact name of the file

Lsof Section Example:
(1) Show the process of opening a file
[Root@mckee ~]# Lsof/var/go/logs/access.log
COMMAND PID USER FD TYPE DEVICE size/off NODE NAME
Blog 4801 Root 4u REG 3,1 132106/var/go/logs/access.log

(2) shows the program that a port is running
[Root@mckee ~]# lsof-i: 3306
COMMAND PID USER FD TYPE DEVICE size/off NODE NAME
Mysqld 1605 MySQL 11u IPv4 5143 0t0 TCP *:mysql (LISTEN)

(3) display a file in which a process name is being opened
[Root@mckee ~]# lsof-c mysqld
COMMAND PID USER FD TYPE DEVICE size/off NODE NAME
Mysqld_sa 1523 root CWD DIR 3,1 4096 2/
Mysqld_sa 1523 root RTD DIR 3,1 4096 2/
Mysqld_sa 1523 root txt REG 3,1 801816 4292633/bin/bash
Mysqld_sa 1523 root mem REG 3,1 144776 3375150/lib64/ld-2.5.so
......

(4) which files are opened by the process that shows a process number
[Root@mckee ~]# lsof-p 4801
command  PID user   fd   TYPE    DEVICE size/off     NODE NAME
blog    4801 root  cwd     dir      3,1     4096   131242/var/go
Blog     4801 root  rtd    dir      3,1      4096        2/
blog    4801 root  txt  & nbsp reg      3,1 11082256   132135/var/go/blog
...

(5) Displays the file that a user is opening
[Root@mckee ~]# lsof-u mysql
command  pid  user   fd   the type& nbsp;            device  SIZE/OFF      NODE NAME
mysqld  1605 mysql  cwd    dir                 3,1      4096   196613/ Var/lib/mysql
mysqld  1605 mysql  rtd    dir                 3,1      4096         2/
mysqld  1605 mysql  txt    reg                 3,1   7744280  2961215/usr/libexec/ Mysqld
...

(6) Print process number
[Root@mckee ~]# LSOF-TC sshd
1453
19954

(7) List all TCP connection information
[Root@mckee ~]# lsof-i TCP