The lsof of Linux commands

Lsof (list open files) is a tool that lists open files for the current system. In a Linux environment, everything is in the form of files, with files that not only access regular data, but also access to network connectivity and hardware. So, such as Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) sockets, the system assigns a file descriptor to the application in the background, regardless of the nature of the file, which provides a common interface for the interaction between the application and the underlying operating system. Because the application opens a descriptor list of files that provides a lot of information about the application itself, it is helpful to see the list through the Lsof tool for system monitoring and troubleshooting.

1. Command format:

lsof [parameters] [file]

2. Command function:

Used to view the files that your process opened, the process that opened the file, the ports that the process opened (TCP, UDP). Lsof accesses the core file, so it must be run as root to fully function.

Lsof open files can be:

1. Common Files

2. Catalogue

3. Files on the network file system

4. character or device file

5. (function) Shared library

6. Piping, Named pipes

7. Symbolic Links

8. Network files (for example: NFS file, network Socket,unix domain name socket)

9. There are other types of files, etc.

3. Command parameters:

-a lists the processes that exist for open files

-c< Process name > List files opened by the specified process

-G list GID process details

-d< File Number > list the process that occupies the file number

+d< directory > List files that are open under directory

+d< directory > recursively list files opened in directory

-n< directory > List files that use NFS

-i< conditions > lists the processes that meet the criteria. （）

-p< Process number > List files opened by the specified process number

-U list UID number process details

-H Display Help information

-V Display version information

4. Usage examples:

[[email protected] ~]# lsofcommand PID USER FD TYPE DEVICE SIZE NODE nameinit     1 root cwd dir 8,2 4096 2/init 1 root rtd dir 8,2 4096 2/init 1 root txt REG 8,2 43496 6121706/sbin/initinit 1 ro                OT mem reg 8,2 143600 7823908/lib64/ld-2.5.soinit 1 root mem reg 8,2 1722304 7823915/lib64/libc-2.5.soinit 1 root mem REG 8,2 23360 7823919/li          B64/libdl-2.5.soinit 1 root mem REG 8,2 95464 7824116/lib64/libselinux.so.1init               1 root mem REG 8,2 247496 7823947/lib64/libsepol.so.1init 1 root 10u FIFO          0,17 1233/dev/initctlmigration 2 root cwd DIR 8,2 4096 2/migration 2 RooT RTD DIR 8,2 4096 2/migration 2 root txt unknown        /PROC/2/EXEKSOFTIRQD 3 root cwd DIR 8,2 4096 2/ksoftirqd 3 root RTD                                        DIR 8,2 4096 2/ksoftirqd 3 root txt unknown       /proc/3/exemigration 4 root cwd DIR 8,2 4096 2/migration 4 root RTD DIR 8,2 4096 2/migration 4 root txt unknown/p                ROC/4/EXEKSOFTIRQD 5 root cwd dir 8,2 4096 2/ksoftirqd 5 root RTD dir 8,2 4096 2/ksoftirqd 5 root txt unknown/proc/5/                exeevents/0 6 root cwd dir 8,2 4096 2/events/0 6 root RTD dir    8,2 4096      2/events/0 6 root txt unknown/proc/6/exeevents/1 7 root CWD DIR 8,2 4096 2/

Description

The meaning of the lsof output column information is as follows:

COMMAND: Name of the process

PID: Process Identifier

PPID: Parent Process Identifier (the-R parameter needs to be specified)

USER: Process Owner

Pgid: The group to which the process belongs

FD: File descriptor in which the application recognizes the file through a file descriptor. such as CWD, TXT, etc.

(1) CWD: Represents the current working dirctory, which is the directory in which the application starts, unless it makes changes to the directory itself

(2) TXT: This type of file is a program code, such as the application binary file itself or a shared library, as shown in the list above/sbin/init program

(3) Lnn:library references (AIX);

(4) ER:FD information error (see NAME column);

(5) Jld:jail directory (FreeBSD);

(6) Ltx:shared Library text (code and data);

(7) Mxx:hex memory-mapped type number XX.

(8) M86:dos Merge mapped file;

(9) mem:memory-mapped file;

(ten) mmap:memory-mapped device;

(one) Pd:parent directory;

(rtd:root) directory;

(Tr:kernel) trace file (OpenBSD);

(+) v86 vp/ix mapped file;

(15) 0: Indicates standard output

(16) 1: Indicates standard input

(17) 2: standard error indication

Generally after standard output, standard error, standard input followed by file state mode: R, W, u, etc.

(1) U: Indicates that the file is open and in read/write mode

(2) R: Indicates that the file is open and is in read-only mode

(3) W: Indicates that the file is open and is in

(4) Space: Indicates that the file's status mode is Unknow and is not locked

(5)-: Indicates that the file's state mode is unknow and is locked

At the same time, after the file state mode, followed by the relevant lock

(1) N:for a Solaris NFS lock of unknown type;

(2) R:for read lock on part of the file;

(3) R:for A read lock on the entire file;

(4) W:for a write lock on part of the file;

(5) W:for a write lock on the entire file; (write lock for entire file)

(6) U:for a read and write lock of any length;

(7) U:for a lock of unknown type;

(8) x:for an SCO openserver Xenix lock in part of the file;

(9) X:for an SCO openserver Xenix lock on the entire file;

(space:if) There is no lock.

Type: File types, such as Dir, Reg, etc., common file types

(1) Dir: Indicates directory

(2) CHR: denotes character type

(3) BLK: Block Device type

(4) Unix:unix domain sockets

(5) FIFO: Advanced First Out (FIFO) queue

(6) IPV4: Internet Protocol (IP) sockets

DEVICE: Specifies the name of the disk

Size: Sizes of files

Node: Index node (the identity of the file on disk)

Name: Open the exact name of the file

Reference:

One Linux command per day: lsof command

lsof command Explanation

The lsof of Linux commands