Linux Command sharing: lsof command, linux Command sharing lsof

Linux Command sharing: lsof command, linux Command sharing lsof

Lsof (listopenfiles) is a tool used to list open files in the current system. In linux, everything exists in the form of a file. Through a file, you can not only access common data, but also access network connections and hardware. Therefore, for example, the transmission control protocol (TCP) and User Datagram Protocol (UDP) sockets, the system assigns a file descriptor to the application at the backend, regardless of the nature of the file, this file descriptor provides a common interface for the interaction between the application and the basic operating system. Because the descriptor list of an Application Opening file provides a large amount of information about the application itself, it is very helpful for system monitoring and troubleshooting to view this list using the lsof tool.

1. Command Format:

Lsof [parameters] [files]

2. command functions:

It is used to view the files opened by your process, the processes opened by the file, and the ports opened by the process (TCP and UDP ). Restore/restore deleted files. Is a very convenient system monitoring tool, because lsof needs to access the core memory and various files, so it needs to be executed by the root user.

The files opened by lsof can be:

1. Common files

2. Directory

3. Network File System Files

4. characters or device files

5. (function) Shared Library

6. Pipe, Named Pipe

7. Symbolic Links

8. Network files (such as NFSfile, network socket, and unix domain socket)

9. There are other types of files, etc.

3. command parameters:

-A: List the processes that open the file.

-C <process name> lists the files opened by a specified process

-G: List GID process details

-D <file number> lists the processes that occupy the file number.

+ D <directory> list opened files in the directory

+ D <directory> recursively list opened files in the directory

-N <directory> List NFS-used files

-I <condition> lists qualified processes. (4, 6, protocol,: Port, @ ip)

-P <process no.> lists the files opened by the specified process no.

-U: List UID process details

-H: Display help information

-V: display version information

4. Example:

Instance 1: No Parameters

Command:

Lsof

Output:

[Root @ localhost ~] # Lsof

COMMANDPIDUSERFDTYPEDEVICESIZENODENAME
Init1rootcwdDIR8, 240962/
Init1rootrtdDIR8, 240962/
Init1roottxtREG8, 2434966121706/sbin/init
Init1rootmemREG8, 21436007823908/lib64/ld-2.5.so
Init1rootmemREG8, 217223047823915/lib64/libc-2.5.so
Init1rootmemREG8, 2233607823919/lib64/libdl-2.5.so
Init1rootmemREG8, 2954647824116/lib64/libselinux. so.1
Init1rootmemREG8, 22474967823947/lib64/libsepol. so.1
Init1root10u1_o0, 171233/dev/initctl
Migration2rootcwdDIR8, 240962/
Migration2rootrtdDIR8, 240962/
Migration2roottxtunknown/proc/2/exe
Ksoftirqd3rootcwdDIR8, 240962/
Ksoftirqd3rootrtdDIR8, 240962/
Ksoftirqd3roottxtunknown/proc/3/exe
Migration4rootcwdDIR8, 240962/
Migration4rootrtdDIR8, 240962/
Migration4roottxtunknown/proc/4/exe
Ksoftirqd5rootcwdDIR8, 240962/
Ksoftirqd5rootrtdDIR8, 240962/
Ksoftirqd5roottxtunknown/proc/5/exe
Events/06rootcwdDIR8, 240962/
Events/06rootrtdDIR8, 240962/
Events/06 roottxtunknown/proc/6/exe
Events/17rootcwdDIR8, 240962/

Note:

The significance of lsof output column information is as follows:

COMMAND: process name

PID: process identifier

PPID: parent process identifier (-R parameter needs to be specified)

USER: process owner

PGID: group to which the process belongs

FD: file descriptor. The application identifies the file through the file descriptor. Such as cwd and txt

(1) cwd: Indicates currentworkdirctory, that is, the current working directory of the application, which is the directory started by the application, unless it changes the directory.

(2) txt: This type of file is the program code, such as the application binary file itself or the shared library. The/sbin/init program shown in the above list

(3) lnn: libraryreferences (AIX );

(4) er: FDinformationerror (seeNAMEcolumn );

(5) jld: jaildirectory (FreeBSD );

(6) ltx: sharedlibrarytext (codeanddata );

(7) mxx: hexmemory-mappedtypenumberxx.

(8) m86: DOSMergemappedfile;

(9) mem: memory-mappedfile;

(10) mmap: memory-mappeddevice;

(11) pd: parentdirectory;

(12) rtd: rootdirectory;

(13) tr: kerneltracefile (OpenBSD );

(14) v86VP/ixmappedfile;

(15) 0: standard output

(16) 1: Standard Input

(17) 2: indicates a standard error.

Generally, standard output, standard error, and standard input are followed by the File status mode: r, w, u, etc.

(1) u: indicates that the file is opened and in read/write mode.

(2) r: indicates that the file is opened and in read-only mode.

(3) w: indicates that the file is opened and

(4) Space: indicates that the State mode of the file is unknow and is not locked.

(5)-: indicates that the State mode of the file is unknow and the file is locked.

At the same time, after the File status mode, related locks are also followed.

(1) N: foraSolarisNFSlockofunknowntype;

(2) r: forreadlockonpartofthefile;

(3) R: forareadlockontheentirefile;

(4) w: forawritelockonpartofthefile; (partial write lock of the file)

(5) W: forawritelockontheentirefile; (write lock for the entire file)

(6) u: forareadandwritelockofanylength;

(7) U: foralockofunknowntype;

(8) x: foranSCOOpenServerXenixlockonpartofthefile;

(9) X: foranSCOOpenServerXenixlockontheentirefile;

(10) space: ifthereisnolock.

TYPE: file TYPE, such as DIR and REG. Common File Types

(1) DIR: indicates the Directory

(2) CHR: character type

(3) BLK: block device type

(4) UNIX: UNIX domain socket

(5) FIFO: FIFO queue

(6) IPv4: Internet Protocol (IP) socket

DEVICE: Specify the disk name.

SIZE: File SIZE

NODE: Index NODE (the identifier of the file on the disk)

NAME: the exact NAME of the opened file.

Instance 2: check who is using a file, that is, find the process related to a file.

Command:

Lsof/bin/bash

Output:

[Root @ localhost ~] # Lsof/bin/bash
COMMANDPIDUSERFDTYPEDEVICESIZENODENAME
Bash24159roottxtREG8, 28015285368780/bin/bash
Bash24909roottxtREG8, 28015285368780/bin/bash
Bash24941roottxtREG8, 28015285368780/bin/bash
[Root @ localhost ~] #

Note:

Example 3: recursively view the file information of a directory

Command:

Lsoftest/test3

Output:

[Root @ localhost ~] # Cd/opt/soft/
[Root @ localhostsoft] # lsoftest/test3
COMMANDPIDUSERFDTYPEDEVICESIZENODENAME
Bash24941rootcwdDIR8, 240962258872 test/test3
Vi24976rootcwdDIR8, 240962258872 test/test3
[Root @ localhostsoft] #

Note:

When + D is used, all subdirectories and files in the corresponding directory will be listed.

Example 4: without the + D option, traverse all the file information in a directory

Command:

Lsof | grep 'test/test3'

Output:

[Root @ localhostsoft] # lsof | grep 'test/test3'

Bash24941rootcwdDIR8, 240962258872/opt/soft/test/test3
Vi24976rootcwdDIR8, 240962258872/opt/soft/test/test3
Vi24976root4uREG8, 2122882258882/opt/soft/test/test3/. log2013.log. swp
[Root @ localhostsoft] #

Note:

Instance 5: lists the files opened by a user.

Command:

Lsof-uusername

Note:

-U option. u is short for user.

Instance 6: lists the files opened by a program process.

Command:

Lsof-cmysql

Note:

-The c option will list all the files of the program starting with mysql. In fact, you can also write lsof | grepmysql, but the first method is obviously less character than the second method.

Instance 7: lists information about multiple open files in multiple processes.

Command:

Lsof-cmysql-capache

Instance 8: lists information about a user and files opened by a process.

Command:

Lsof-utest-cmysql

Note:

Users and processes can be related or irrelevant.

Instance 9: lists information about open files except for those used outdoors.

Command:

Lsof-u ^ root

Note:

^ Before the user name, the process opened by the root user will not be displayed.

Instance 10: displays the file opened by a process number

Command:

Lsof-p1

Instance 11: lists the file information corresponding to multiple process numbers.

Command:

Lsof-p1, 2, 3

Instance 12: lists the files opened by other process numbers except for a specific process number.

Command:

Lsof-p ^ 1

Instance 13: list all network connections

Command:

Lsof-I

Instance 14: Lists All tcp network connection information

Command:

Lsof-itcp

Instance 15: list all udp network connection information

Command:

Lsof-iudp

Instance 16: list who is using a port

Command:

Lsof-I: 3306

Instance 17: list who is using a specific udp port

Command:

Lsof-iudp: 55

Or: a specific tcp port

Command:

Lsof-itcp: 80

Instance 18: list all active network ports of a user

Command:

Lsof-a-utest-I

Instance 19: list all network file systems

Command:

Lsof-N

Instance 20: domain name socket File

Command:

Lsof-u

Instance 21: File Information opened by a user group

Command:

Lsof-g5555

Instance 22: list the corresponding file information based on the file description

Command:

Lsof-ddescription (like2)

Example: lsof-dtxt

Example: lsof-d1

Example: lsof-d2

Note:

0 indicates the standard input, 1 indicates the standard output, and 2 indicates the standard error. Therefore, most files opened by applications start with 3.

Instance 23: list file information according to the file description range

Command:

Lsof-d2-3

Instance 24: list the file information that contains the string "sshd" in the COMMAND column and the file type is txt.

Command:

Lsof-csshd-a-dtxt

Output:

[Root @ localhostsoft] # lsof-csshd-a-dtxt
COMMANDPIDUSERFDTYPEDEVICESIZENODENAME
Sshd2756roottxtREG8, 24094881027867/usr/sbin/sshd
Sshd24155roottxtREG8, 24094881027867/usr/sbin/sshd
Sshd24905roottxtREG8, 24094881027867/usr/sbin/sshd
Sshd24937roottxtREG8, 24094881027867/usr/sbin/sshd
[Root @ localhostsoft] #
[Root @ localhostsoft] #

Instance 25: Lists All IPV4networkfiles opened by processes with process number 1234.

Command:

Lsof-i4-a-p1234

Instance 26: list all file information related to ports 20, 21, and on the currently connected host peida. linux, and continuously execute the lsof command every 3 seconds.

Command:

Lsof-i@peida.linux: 20, 21,-r3