Linux command detailed--lsof__linux

Lsof Full Name list opened files, which is to enumerate the file that has been opened in the system. We all know that in a Linux environment, everything is a file,
Devices are files, directories are files, and even sockets are files. So, with a good lsof command, it's very helpful for day-to-day Linux management.

Common parameters

A common use for lsof is to find the name and number of files that an application opens. Can be used to find out where a particular application records log data, or is tracking a problem.

For example, Linux restricts the number of files that a process can open. This is usually a large number, so there is no problem, and when needed, the application can request a larger value (until a

lsof [options] FileName

lsof  filename Displays the results of all processes that open the specified file
lsof-a indicates that two parameters must be satisfied
lsof-c string   displays all open files for the process containing the specified character in the command column
lsof-u username  Displays the files that are opened by the owning user process
Lsof-g GID shows the process status of the attribution GID
lsof +d/dir/The files that were opened by the process in the display directory
lsof +d/dir/ Ditto, but will search all directories under the directory, the time is relatively long
lsof-d FD displays the process lsof-n the specified file descriptor
does not convert IP to hostname, and the default is not to add the-n parameter
lsof-i Used to show the conditions of the process
lsof-i[46] [protocol][@hostname |hostaddr][:service|port]
            --> IPv4 or IPv6
            Protocol--> TCP or UDP
            hostname--> Internet host name
            hostaddr--> IPv4 address
            service-->/etc/se Service name in Rvice (can be more than one) port
            --> port number (can be more than one)

Lsof is one of the most common commands for Linux, and the usual output format is:

Reference
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME

Common examples include the following fields: more visible manual.

1. COMMAND
The name of the command that is displayed by default in 9 character lengths. You can use the +c parameter to specify the width of the display and, if the parameter followed by +c is zero, display the full name of the command
2, PID: The ID number of the process
3, PPID
The IP number of the parent process, which is not displayed by default, can be opened when using the-R parameter.
4, Pgid
The ID number of the process group, which is not displayed by default, and can be opened when the-G parameter is used.
5, USER
The execution uid of the command or the name of the user logged on in the system. The default display is the user name, and the UID can be displayed when the-l parameter is used.
6. FD
Is the file descriptor number, or the following:
(It is difficult to translate the corresponding meaning, keep English)

Reference
CWD Current working directory;
Lnn Library references (AIX);
JLD Jail directory (FreeBSD);
LTX Shared library text (code and data);
MXX hex memory-mapped type number XX.
M86 DOS Merge mapped file;
Mem memory-mapped file;
Mmap memory-mapped device;
PD parent Directory;
RTD root directory;
TR Kernel trace file (OpenBSD);
TXT program text (Code and data);
V86 Vp/ix mapped file;

The file descriptor number display mode is:

Reference
R for Read access;
W for write access;
U for read and write access;
N for a Solaris NFS lock of unknown type;
R for read lock on part of the file;
R for a read lock on the entire file;
W for a write lock on the file;
W for a write lock on the entire file;
U for a read and write lock the any length;
U for a lock of unknown type;
X for a SCO openserver Xenix lock on the file;
X for a SCO openserver Xenix lock on the entire file;
Space if there is no lock.

7, TYPE

Reference
IPv4 IPv4 bag;
IPV6 uses the IPV6 format package, even if the address is IPv4, will be displayed as IPV6, and map to the IPV6 address;
Dir directory
Link Linked file

See more comments in the manual for details.

8, DEVICE
Use the device number represented by character special, block special
9, SIZE
The size of the file, if it cannot be represented by size, is left blank. Control using the-s parameter.
10, NODE
Node code for local files, or protocols such as TCP, etc.
11, NAME
The full path of the mount point and file (the link will be resolved to the actual path), or the address and port, status, etc. of the connecting parties

Common examples:

1. Show the process of opening file/home/oracle/10.2.0/db_1/bin/tnslsnr

[Root@svr-db-test ~]# Lsof/home/oracle/10.2.0/db_1/bin/tnslsnr
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
Tnslsnr 3520 Oracle txt REG 253,5 431062 11408866/home/oracle/10.2.0/db_1/bin/tnslsnr

2. Know what program the 22 port is running now

[Root@svr-db-test ~]# lsof-i: 22
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
sshd 3101 root 3u IPv6 8670 TCP *:ssh (LISTEN)
sshd 4545 root 3u IPv6 4237972 TCP 203.aibo.com:ssh->win-avbmq9e8ka7.gdgg.local:nsjtp-ctrl (established)

3. Show files that the init process is now open

[Root@svr-db-test ~]# lsof-c Init
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
Init 1 root cwd DIR 253,0 4096 2/
Init 1 root RTD DIR 253,0 4096 2/
Init 1 root txt REG 253,0 43496 524446/sbin/init
Init 1 root mem REG 253,0 130448 917826/lib64/ld-2.5.so
Init 1 root mem REG 253,0 1678480 917827/lib64/libc-2.5.so
Init 1 root mem REG 253,0 23520 917686/lib64/libdl-2.5.so
Init 1 root mem REG 253,0 247528 917844/lib64/libsepol.so.1
Init 1 root mem REG 253,0 95480 917845/lib64/libselinux.so.1
Init 1 root 10u FIFO 0,16 2311/dev/initctl

4. See what files are open for process number 1

[Root@svr-db-test ~]# lsof-p 1
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
Init 1 root cwd DIR 253,0 4096 2/
Init 1 root RTD DIR 253,0 4096 2/
Init 1 root txt REG 253,0 43496 524446/sbin/init
Init 1 root mem REG 253,0 130448 917826/lib64/ld-2.5.so
Init 1 root mem REG 253,0 1678480 917827/lib64/libc-2.5.so
Init 1 root mem REG 253,0 23520 917686/lib64/libdl-2.5.so
Init 1 root mem REG 253,0 247528 917844/lib64/libsepol.so.1
Init 1 root mem REG 253,0 95480 917845/lib64/libselinux.so.1
Init 1 root 10u FIFO 0,16 2311/dev/initctl

5. Status of the process showing attribution 3520

[Root@svr-db-test ~]# lsof-g 3520
COMMAND PID pgid USER FD TYPE DEVICE SIZE NODE NAME
Tnslsnr 3520 3520 Oracle CWD DIR 253,5 4096 11059201/home/oracle
Tnslsnr 3520 3520 Oracle RTD DIR 253,0 4096 2/
Tnslsnr 3520 3520 Oracle txt REG 253,5 431062 11408866/home/oracle/10.2.0/db_1/bin/tnslsnr
Tnslsnr 3520 3520 Oracle mem REG 253,0 130448 917826/lib64/ld-2.5.so
Tnslsnr 3520 3520 Oracle mem REG 253,0 1678480 917827/lib64/libc-2.5.so
Tnslsnr 3520 3520 Oracle mem REG 253,0 23520 917686/lib64/libdl-2.5.so
Tnslsnr 3520 3520 Oracle mem REG 253,0 615136 917834/lib64/libm-2.5.so
Tnslsnr 3520 3520 Oracle mem REG 253,0 141208 917829/lib64/libpthread-2.5.so
Tnslsnr 3520 3520 Oracle mem REG 253,0 109824 917839/lib64/libnsl-2.5.so
Tnslsnr 3520 3520 Oracle mem REG 253,5 20706622 11405436/home/oracle/10.2.0/db_1/lib/libclntsh.so.10.1
Tnslsnr 3520 3520 Oracle mem REG 253,5 3803097 11410641/home/oracle/10.2.0/db_1/lib/libnnz10.so
Tnslsnr 3520 3520 Oracle mem REG 253,5 83493 11407251/home/oracle/10.2.0/db_1/lib/libons.so
Tnslsnr 3520 3520 Oracle mem REG 253,0 53880 917532/lib64/libnss_files-2.5.so
Tnslsnr 3520 3520 Oracle mem REG 253,5 8545 11407615/home/oracle/10.2.0/db_1/lib/libskgxn2.so
Tnslsnr 3520 3520 Oracle mem REG 253,5 513705 11410332/home/oracle/10.2.0/db_1/lib/libocrutl10.so
Tnslsnr 3520 3520 Oracle mem REG 253,5 636161 11410330/home/oracle/10.2.0/db_1/lib/libocr10.so
Tnslsnr 3520 3520 Oracle mem REG 253,5 657825 11410331/home/oracle/10.2.0/db_1/lib/libocrb10.so
Tnslsnr 3520 3520 Oracle mem REG 253,5 1745769 11410365/home/oracle/10.2.0/db_1/lib/libhasgen10.so
Tnslsnr 3520 3520 Oracle mem REG 253,5 61985 11410366/home/oracle/10.2.0/db_1/lib/libclsra10.so
Tnslsnr 3520 3520 Oracle 0u CHR 1,3 2553/dev/null
Tnslsnr 3520 3520 Oracle 1u CHR 1,3 2553/dev/null
Tnslsnr 3520 3520 Oracle 2u CHR 1,3 2553/dev/null
Tnslsnr 3520 3520 Oracle 3w REG 253,5 318853012 11633459/home/oracle/10.2.0/db_1/network/log/listener.l og
Tnslsnr 3520 3520 Oracle 4r FIFO 0,6 15661 Pipe
Tnslsnr 3520 3520 Oracle 5r REG 253,5 11776 11410579/HOME/ORACLE/10.2.0/DB_1/NETWORK/MESG/NLUS.MSB
Tnslsnr 3520 3520 Oracle 6r REG 253,5 46592 11407160/HOME/ORACLE/10.2.0/DB_1/NETWORK/MESG/TNSUS.MSB
Tnslsnr 3520 3520 Oracle 7w FIFO 0,6 15662 Pipe
Tnslsnr 3520 3520 Oracle 8u IPv4 15665 TCP 203.aibo.com:ncube-lm (LISTEN)
Tnslsnr 3520 3520 Oracle 9u UNIX 0xffff81021b7d6980 15666/var/tmp/.oracle/s#3520.1
Tnslsnr 3520 3520 Oracle 10u UNIX 0xffff81021b7d66c0 15668/var/tmp/.oracle/s#3520.2

6. Search according to folder/home/oracle, but will not open subdirectories, used to display the directory under the process to open files

[Root@svr-db-test ~]# lsof +d/home/oracle
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
Tnslsnr 3520 Oracle CWD DIR 253,5 4096 11059201/home/oracle

7. Open the/home/oracle folder and its subdirectory search to display files that are opened by the process in the directory

[Root@svr-db-test ~]# lsof +d/home/oracle

Too many displays, no display

8. Lsof-i to show the conditions of the process

Syntax: lsof-i[46] [protocol][@hostname |hostaddr][:service|port]

--> IPv4 or IPv6

Protocol--> TCP or UDP

Hostname--> Internet Host name

Hostaddr--> IPv4 Position

Service name in service-->/etc/service (can be more than one)

Port--> Port number (can be more than one)

Example:

[Root@svr-db-test ~]# lsof-i Tcp@192.168.2.245:1521-n
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
Oracle 15633 Oracle 16u IPV4 4069605 TCP 192.168.2.203:31580->192.168.2.245:NCUBE-LM (established)

Or

[Root@svr-db-test ~]# lsof-i tcp@192.168.2.245:1521
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
Oracle 15633 Oracle 16u IPV4 4069605 TCP 203.AIBO.COM:31580->192.168.2.245:NCUBE-LM (established)

Lsof-n does not convert IP to hostname, the default is not to add-n parameter

9. Display a file that has been opened by a user (or a file that has been opened by the user executing program)

[Root@svr-db-test ~]# Lsof-u Oracle
Or
[Root@svr-db-test ~]# lsof-u 0

10. Printing process only to facilitate shell script calls

[Root@svr-db-test ~]# LSOF-TC sshd
3101
4545