Linux:lsof command

Lsof is the abbreviation for List open files, on Linux and other Unix, and on Mac Xos

View open files/directories and corresponding processes

        command-line string pid            process iduser           user fd             TXT (process program file), CWD (process current present), Mem (),                FDIDUWR The open representation ID of the file within the process, followed by the letter indicating the mode of operation type           REG (general file), DIR (directory), CHR (character device file), FIFO (pipeline), IPV4 (IPV4 network socket) devicesize/  Offnodename           file path

Sample output:

COMMAND PID TID USER FD TYPE DEVICE size/OFF NODE nameinit1Root CWD DIR8,1     4096          2/Init1Root RTD DIR8,1     4096          2/Init1Root txt REG8,1   265848    2621507/sbin/Initinit1Root Mem REG8,1    47712    3149879/lib/x86_64-linux-gnu/Libnss_files-2.19. So

To view a file/directory using the process, directly after the command with the file/directory name:

# lsof Server_timecommand     PID USER  FD   TYPE DEVICE SIZE/OFF    20999  hgf txt    REG    8, 1     9190 1442691 ./server_time

# lsof/home/hgf/netcommand PID USER FD TYPE DEVICE SIZE/OFF NODE Namebash10075HGF CWD DIR8,1     4096 1442896/home/hgf/Netbash15706HGF CWD DIR8,1     4096 1442896/home/hgf/Netbash18324HGF CWD DIR8,1     4096 1442896/home/hgf/Netbash18573HGF CWD DIR8,1     4096 1442896/home/hgf/Netsudo      20730Root CWD DIR8,1     4096 1442896/home/hgf/Netsu        20740Root CWD DIR8,1     4096 1442896/home/hgf/Netbash20741Root CWD DIR8,1     4096 1442896/home/hgf/Netserver_ti20999HGF CWD DIR8,1     4096 1442896/home/hgf/netlsof21814Root CWD DIR8,1     4096 1442896/home/hgf/netlsof21815Root CWD DIR8,1     4096 1442896/home/hgf/net

View deleted files

The deleted file here refers to the file being opened by some process, but the file on disk has been deleted (see the results listed in the directory). These files actually exist on disk and can be found by using lsof

# lsof|grepDeletedinit1Root 10WReg8,1      969    2360289/var/log/upstart/systemd-logind.log.1(deleted) Init1Root 27WReg8,1     1406    2360292/var/log/upstart/modemmanager.log.1(Deleted)
...
... server_ti20999HGF txt REG8,1     9190    1442691/home/hgf/net/server_time (Deleted)

In this case, we can copy the program files from the/proc file system in the corresponding PID directory.

[Email protected]:/proc/20999# Lltotal0Dr-xr-xr-x9HGF HGF0May7 Ten: About./Dr-xr-xr-x262Root root0Feb5 xx: -.. /Dr-xr-xr-x2HGF HGF0May7  One: theattr/-rw-r--r--1HGF HGF0May7  One: theAutogroup-R--------1HGF HGF0May7  One: theAUXV-r--r--r--1HGF HGF0May7  One: theCgroup--W-------1HGF HGF0May7  One: theClear_refs-r--r--r--1HGF HGF0May7  One: theCmdLine-rw-r--r--1HGF HGF0May7  One: theComm-rw-r--r--1HGF HGF0May7  One: theCoredump_filter-r--r--r--1HGF HGF0May7  One: thecpusetlrwxrwxrwx1HGF HGF0May7 Ten: About--------,/home/hgf/net/-r, CWD1HGF HGF0May7  One: theenvironlrwxrwxrwx1HGF HGF0May7 Ten: AboutEXE-/home/hgf/net/Server_time (deleted) Dr-X------2HGF HGF0May7 Ten: Aboutfd/... [Email protected]:/proc/20999#CPEXE ~/

If the program opens a file other than the program itself, you can find the corresponding descriptor number in the FD directory

Linux:lsof command