Linux lsof Command detailed

Lsof is a very important command in Linux, and here's a quick record.

Brief introduction

Lsof (list open files) is a tool that lists the current system open file. In a Linux environment, everything exists as a file, and access to network connections and hardware can be accessed through files, not just regular data. As a result, such as Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) sockets, the system assigns a file descriptor to the application in the background, regardless of the nature of the file, which provides a common interface for interaction between the application and the underlying operating system. Because the application opens a list of file descriptors that provide a lot of information about the application itself, the ability to view this list through the Lsof tool can be very helpful for system monitoring and error scheduling.

Lsof Full Name list open files, meaning to display the open file list.

We all know that in the Linux world, all things are files, the operation of things is the operation of the file.

For example, the device is a file, the directory is a file, the socket is a file. We can get a lot of useful information through the lsof command.

tiankonguse:~ $ lsof-i-N
COMMAND PID USER FD TYPE DEVICE size/off NODE NAME
SSH 3860 tiankonguse 3u IPv4 277226 0t0 TCP 192.168.31.137:55470->52.175.36.207:SSH (established)
SSH 3860 Tiankonguse 4u IPv6 277256 0t0 TCP [:: 1]:7070 (LISTEN)
SSH 3860 tiankonguse 5u IPv4 277257 0t0 TCP 127.0.0.1:7070 (LISTEN)
SSH 3860 tiankonguse 9u IPv4 392596 0t0 TCP 127.0.0.1:7070->127.0.0.1:47308 (close_wait)
SSH 3860 tiankonguse 10u IPv4 425556 0t0 TCP 127.0.0.1:7070->127.0.0.1:47424 (established)
SSH 3860 tiankonguse 11u IPv4 474716 0t0 TCP 127.0.0.1:7070->127.0.0.1:47436 (established)
Chrome 31615 tiankonguse 102u IPv4 474141 0t0 TCP 192.168.31.137:54857->220.181.76.72:http (close_wait)
Chrome 31615 tiankonguse 103u IPv4 424629 0t0 TCP 127.0.0.1:47424->127.0.0.1:7070 (established)
Chrome 31615 tiankonguse 104u IPv4 432692 0t0 TCP 192.168.31.137:36335->203.208.50.175:https (established)
Chrome 31615 tiankonguse 106u IPv4 476207 0t0 TCP 127.0.0.1:47436->127.0.0.1:7070 (established)
Chrome 31615 tiankonguse 111u IPv4 273013 0t0 UDP *:mdns

Field Introduction

Lsof The default display field is COMMAND PID USER FD TYPE DEVICE size/off NODE NAME.

The meanings are as follows:

Command program command, which defaults to the names of the commands displayed with a length of 9 characters. You can use the +c parameter to specify the width of the display and, if the parameter followed by +c is zero, display the full name of the command
PID Process ID
The IP number of the PPID parent process is not displayed by default, and can be opened when using the-R parameter.
The ID number of the Pgid process group, which is not displayed by default, can be opened when the-G parameter is used.
The execution uid of the user command or the name of the user logged on in the system. The default display is the user name, and the UID can be displayed when the-l parameter is used.
FD File Descriptor
TYPE IPV4 Package, IPV6 package, DIR directory, link link file, etc.
DEVICE the device number represented by character special, block special
The size of the Size/off file, if it cannot be represented by size, is left blank. Control using the-s parameter.
node-local file node code, or protocol, such as TCP
The NAME mount point and the full path of the file (the link is resolved to the actual path), or the address and port of the connection, status, etc.
Use

View ports

tiankonguse:~ $ lsof-i: 80
COMMAND PID USER FD TYPE DEVICE size/off NODE NAME
Chrome 31615 tiankonguse 102u IPv4 537284 0t0 TCP 192.168.31.137:41976->117.79.92.146:http (close_wait)
Chrome 31615 tiankonguse 104u IPv4 539670 0t0 TCP 192.168.31.137:34899->151.101.16.133:http (established)
Chrome 31615 tiankonguse 105u IPv4 539781 0t0 TCP 192.168.31.137:60814->93-46-8-89.ip105.fastwebnet.it:http (S Yn_sent)
Chrome 31615 tiankonguse 118u IPv4 537818 0t0 TCP 192.168.31.137:34900->151.101.16.133:http (established)
Chrome 31615 tiankonguse 122u IPv4 537900 0t0 TCP 192.168.31.137:60815->93-46-8-89.ip105.fastwebnet.it:http (S Yn_sent)
Chrome 31615 tiankonguse 124u IPv4 538905 0t0 TCP 192.168.31.137:41978->117.79.92.146:http (close_wait)
Chrome 31615 tiankonguse 128u IPv4 538906 0t0 TCP 192.168.31.137:41979->117.79.92.146:http (close_wait)
Chrome 31615 tiankonguse 155u IPv4 539020 0t0 TCP 192.168.31.137:34901->151.101.16.133:http (established)
Chrome 31615 tiankonguse 170u IPv4 539036 0t0 TCP 192.168.31.137:58368->220.181.7.190:http (close_wait)
Chrome 31615 tiankonguse 174u IPv4 539021 0t0 TCP 192.168.31.137:34902->151.101.16.133:http (established)
Chrome 31615 tiankonguse 183u IPv4 539022 0t0 TCP 192.168.31.137:34903->151.101.16.133:http (established)
Chrome 31615 tiankonguse 184u IPv4 539023 0t0 TCP 192.168.31.137:34904->151.101.16.133:http (established)

View process Name

tiankonguse:~ $ lsof-c Chrome | More
Lsof:WARNING:can ' t stat () EXT4 file System/var/lib/docker/aufs
Output information may is incomplete.
COMMAND PID USER FD TYPE DEVICE size/off NODE NAME
Chrome 1880 Tiankonguse CWD DIR 0,3 0 24098/proc/31953/fdinfo
Chrome 1880 tiankonguse RTD DIR 0,3 0 24098/proc/31953/fdinfo
Chrome 1880 Tiankonguse txt REG 8,2 99609936 24248328/opt/google/chrome/chrome
Chrome 1880 Tiankonguse DEL REG 0,21 52587/run/shm/.com.google.chrome.se37st

View process Number

tiankonguse:~ $ lsof-p 2127
Lsof:WARNING:can ' t stat () EXT4 file System/var/lib/docker/aufs
Output information may is incomplete.
COMMAND PID USER FD TYPE DEVICE size/off NODE NAME
Apache2 2127 root CWD unknown/proc/2127/cwd (Readlink:permission denied)
Apache2 2127 Root RTD unknown/proc/2127/root (Readlink:permission denied)
Apache2 2127 Root txt unknown/proc/2127/exe (readlink:permission denied)
Apache2 2127 Root Nofd
/PROC/2127/FD (Opendir:permission denied)
Viewing process Groups

tiankonguse:~ $ lsof-g 2127
Lsof:WARNING:can ' t stat () EXT4 file System/var/lib/docker/aufs
Output information may is incomplete.
COMMAND PID pgid USER FD TYPE DEVICE size/off NODE NAME
Apache2 2127 2127 root cwd unknown/proc/2127/cwd (Readlink:permission denied)
Apache2 2127 2127 Root RTD unknown/proc/2127/root (Readlink:permission denied)
Apache2 2127 2127 Root txt unknown/proc/2127/exe (readlink:permission denied)
Apache2 2127 2127 Root nofd/proc/2127/fd (Opendir:permission denied)
Apache2 2156 2127 www-data cwd unknown/proc/2156/cwd (Readlink:permission denied)
Apache2 2156 2127 www-data RTD unknown/proc/2156/root (Readlink:permission denied)
Apache2 2156 2127 www-data txt unknown/proc/2156/exe (readlink:permission denied)
...
View Table of Contents

Lsof +d/home/
The Almighty Other

grep search, such as finding files that were deleted but not released.

lsof | grep xxx