Lsof is the abbreviation for List open files, on Linux and other Unix, and on Mac Xos
View open files/directories and corresponding processes
command-line string pid process iduser user fd TXT (process program file), CWD (process current present), Mem (), FDIDUWR The open representation ID of the file within the process, followed by the letter indicating the mode of operation type REG (general file), DIR (directory), CHR (character device file), FIFO (pipeline), IPV4 (IPV4 network socket) devicesize/ Offnodename file path
Sample output:
COMMAND PID TID USER FD TYPE DEVICE size/OFF NODE nameinit1Root CWD DIR8,1 4096 2/Init1Root RTD DIR8,1 4096 2/Init1Root txt REG8,1 265848 2621507/sbin/Initinit1Root Mem REG8,1 47712 3149879/lib/x86_64-linux-gnu/Libnss_files-2.19. So
To view a file/directory using the process, directly after the command with the file/directory name:
# lsof Server_timecommand PID USER FD TYPE DEVICE SIZE/OFF 20999 hgf txt REG 8, 1 9190 1442691 ./server_time
# lsof/home/hgf/netcommand PID USER FD TYPE DEVICE SIZE/OFF NODE Namebash10075HGF CWD DIR8,1 4096 1442896/home/hgf/Netbash15706HGF CWD DIR8,1 4096 1442896/home/hgf/Netbash18324HGF CWD DIR8,1 4096 1442896/home/hgf/Netbash18573HGF CWD DIR8,1 4096 1442896/home/hgf/Netsudo 20730Root CWD DIR8,1 4096 1442896/home/hgf/Netsu 20740Root CWD DIR8,1 4096 1442896/home/hgf/Netbash20741Root CWD DIR8,1 4096 1442896/home/hgf/Netserver_ti20999HGF CWD DIR8,1 4096 1442896/home/hgf/netlsof21814Root CWD DIR8,1 4096 1442896/home/hgf/netlsof21815Root CWD DIR8,1 4096 1442896/home/hgf/net
View deleted files
The deleted file here refers to the file being opened by some process, but the file on disk has been deleted (see the results listed in the directory). These files actually exist on disk and can be found by using lsof
# lsof|grepDeletedinit1Root 10WReg8,1 969 2360289/var/log/upstart/systemd-logind.log.1(deleted) Init1Root 27WReg8,1 1406 2360292/var/log/upstart/modemmanager.log.1(Deleted)
...
... server_ti20999HGF txt REG8,1 9190 1442691/home/hgf/net/server_time (Deleted)
In this case, we can copy the program files from the/proc file system in the corresponding PID directory.
[Email protected]:/proc/20999# Lltotal0Dr-xr-xr-x9HGF HGF0May7 Ten: About./Dr-xr-xr-x262Root root0Feb5 xx: -.. /Dr-xr-xr-x2HGF HGF0May7 One: theattr/-rw-r--r--1HGF HGF0May7 One: theAutogroup-R--------1HGF HGF0May7 One: theAUXV-r--r--r--1HGF HGF0May7 One: theCgroup--W-------1HGF HGF0May7 One: theClear_refs-r--r--r--1HGF HGF0May7 One: theCmdLine-rw-r--r--1HGF HGF0May7 One: theComm-rw-r--r--1HGF HGF0May7 One: theCoredump_filter-r--r--r--1HGF HGF0May7 One: thecpusetlrwxrwxrwx1HGF HGF0May7 Ten: About--------,/home/hgf/net/-r, CWD1HGF HGF0May7 One: theenvironlrwxrwxrwx1HGF HGF0May7 Ten: AboutEXE-/home/hgf/net/Server_time (deleted) Dr-X------2HGF HGF0May7 Ten: Aboutfd/... [Email protected]:/proc/20999#CPEXE ~/
If the program opens a file other than the program itself, you can find the corresponding descriptor number in the FD directory
Linux:lsof command