Lsof is a powerful diagnostic tool that can be used to contact open files through a process and can list all the file information opened by a process.
1 finding the process associated with an open file
By specifying a file, you can discover the process that is using the file
# lsof/var/log/messages
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
SYSLOGD 1968 Root 1w REG 3,9 219245 780490/var/log/messages
As you can see, only the System record Daemon (SYSLOGD) has opened this file.
2 Unblocking with lsof
Sometimes you want to uninstall a file system with Umount, but the program reports that the file system is busy, and it needs to be until which files, programs, or Users
The system is still in use, you can execute the following command
#lsof Mountpoint//mountpoint is a mount point
Note that sometimes lsof cannot find any open files in a section, but it still appears as busy. In this case, the kernel in the file system is described
An internal reference to one or more files. In this case, the only solution is to wait for the reference to disappear or to activate it in the/etc/fstab directory
The file system installs the entity appropriately and restarts.
3 Searching for open Network connections
Parameter I can search all open sockets in the system
If you want to search all network connections for a remote host with IP address 192.168.0.100, you can perform lsof [email protected]
The remote host IP is assumed to be 127.0.0.1 because of the native test
# lsof [email protected]
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
xinetd 2119 root 5u IPv4 2409 TCP localhost.localdomain:32769 (LISTEN)
CUPSD 2160 root 0u IPv4 2537 TCP Localhost.localdomain:ipp (LISTEN)
Fam 2401 Root 0u IPv4 2409 TCP localhost.localdomain:32769 (LISTEN)
Fam 2401 Root 1u IPv4 2409 TCP localhost.localdomain:32769 (LISTEN)
Fam 2401 Root 2u IPv4 2409 TCP localhost.localdomain:32769 (LISTEN)
Lsof reports several commands connected to the 127.0.0.1 address.
Netstat and lsof can be used in conjunction with. lsof [email protected] can be connected to the remote host 192.168.0.100 process,
The process runs on a port on the local host
# lsof [email protected]
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
xinetd 2119 root 5u IPv4 2409 TCP localhost.localdomain:32769 (LISTEN)
CUPSD 2160 root 0u IPv4 2537 TCP Localhost.localdomain:ipp (LISTEN)
Fam 2401 Root 0u IPv4 2409 TCP localhost.localdomain:32769 (LISTEN)
Fam 2401 Root 1u IPv4 2409 TCP localhost.localdomain:32769 (LISTEN)
Fam 2401 Root 2u IPv4 2409 TCP localhost.localdomain:32769 (LISTEN)
4 Search All files opened by the program
To know which files are opened by a particular program, you can perform the Lsof-p PID, which is commonly used with PS
#ps-aux
.......
Root 2324 0.1 3.6 14860 9236? S 21:22 0:02 FCITX
......
# Lsof-p 2324
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
Fcitx 2324 root cwd DIR 3,9 4096 290881/root
FCITX 2324 root RTD DIR 3,9 4096 2/
FCITX 2324 root txt REG 3,9 125784 341397/usr/bin/fcitx
FCITX 2324 root mem REG 3,9 103044 775758/lib/ld-2.3.2.so
FCITX 2324 root mem REG 3,9 21040 81056/usr/lib/gconv/gconv-modules.cache
FCITX 2324 root mem REG 3,9 6404 80912/usr/lib/gconv/gbgbk.so
FCITX 2324 root mem REG 3,9 19960 759919/usr/x11r6/lib/x11/locale/lib/common/xlibi18n.so.2
FCITX 2324 root mem REG 3,9 3740 759918/usr/x11r6/lib/x11/locale/lib/common/xlcutf8load.so.2
FCITX 2324 root mem REG 3,9 908016 420807/usr/x11r6/lib/libx11.so.6.2
FCITX 2324 root mem REG 3,9 15084 775769/lib/libdl-2.3.2.so
FCITX 2324 root mem REG 3,9 30301680 468656/usr/lib/locale/locale-archive
FCITX 2324 root mem REG 3,9 105776 80913/usr/lib/gconv/gbk.so
FCITX 2324 root mem REG 3,9 36456 759921/usr/x11r6/lib/x11/locale/lib/common/xomgeneric.so.2
FCITX 2324 root mem REG 3,9 177636 80910/usr/lib/gconv/gb18030.so
FCITX 2324 root mem REG 3,9 1531064 290959/lib/tls/libc-2.3.2.so
Fcitx 2324 root 0r CHR 1,3 66358/dev/null
FCITX 2324 Root 1w REG 3,9 587 293627/root/.xsession-errors
Fcitx 2324 Root 2w REG 3,9 587 293627/root/.xsession-errors
FCITX 2324 root 3u unix 0xcc01a580 2750 socket
The above output information shows all files, devices, libraries, and network sockets opened by the process.
If you want to find all instances of a command and files opened by each instance, you can use parameter C, such as
[Email protected] root]# lsof-c sshd
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
sshd 2105 root CWD DIR 3,9 4096 2/
sshd 2105 Root RTD DIR 3,9 4096 2/
sshd 2105 Root txt REG 3,9 278552 388141/usr/sbin/sshd
sshd 2105 root mem REG 3,9 103044 775758/lib/ld-2.3.2.so
sshd 2105 root mem REG 3,9 28452 355792/usr/lib/libwrap.so.0.7.6
sshd 2105 root mem REG 3,9 30448 776067/lib/libpam.so.0.75
sshd 2105 root mem REG 3,9 15084 775769/lib/libdl-2.3.2.so
sshd 2105 root mem REG 3,9 76552 775789/lib/libresolv-2.3.2.so
sshd 2105 root mem REG 3,9 12696 775795/lib/libutil-2.3.2.so
sshd 2105 root mem REG 3,9 52616 355669/usr/lib/libz.so.1.1.4
sshd 2105 root mem REG 3,9 91604 775773/lib/libnsl-2.3.2.so
sshd 2105 root mem REG 3,9 968956 776055/lib/libcrypto.so.0.9.7a
sshd 2105 root mem REG 3,9 385220 759686/usr/kerberos/lib/libkrb5.so.3.1
sshd 2105 root mem REG 3,9 63880 759676/usr/kerberos/lib/libk5crypto.so.3.0
sshd 2105 root mem REG 3,9 5572 759666/usr/kerberos/lib/libcom_err.so.3.0
sshd 2105 root mem REG 3,9 73756 759672/usr/kerberos/lib/libgssapi_krb5.so.2.2
sshd 2105 root mem REG 3,9 52472 775779/lib/libnss_files-2.3.2.so
sshd 2105 root mem REG 3,9 1531064 290959/lib/tls/libc-2.3.2.so
sshd 2105 root 0u CHR 1,3 66358/dev/null
sshd 2105 root 1u CHR 1,3 66358/dev/null
sshd 2105 Root 2u CHR 1,3 66358/dev/null
sshd 2105 root 3u IPv4 2377 TCP *:ssh (LISTEN)
Displays all instances of the SSHD server and the files they openTo see if a port is being used by that program, you can[email protected] root]#lsof-i:3306
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
MySQL 4818 secu 3u IPv4 1299676962 TCP 172.27.32.33:50435->10.128.12.99:mysql (established)
Getnetala 12543 secu 3u IPv4 1299638828 TCP 172.27.32.33:36972->172.27.32.33:mysql (established)
Getnetala 12543 SECU 4u IPv4 1299653048 TCP 172.27.32.33:44175->10.128.12.99:mysql (established)
Perl 21621 SECU 4u IPv4 1299702234 TCP 172.27.32.33:42349->172.27.57.13:mysql (established)
Perl 21623 SECU 4u IPv4 1299702235 TCP 172.27.32.33:42350->172.27.57.13:mysql (established)
The Lsof tool lists a list of open file information for a UNIX process, which may include: Local files, directories, network shared files, block device files, character device files, shared libraries, pipelines, soft links, sockets, and so on.
Here is a summary of the specific lsof operation examples:
1, List all open file information
#lsof
2. View an open file information
#lsof/path/to/file
#lsof/path/to/file1/path/to/file2
3. List open files in a directory
#lsof +d/path
#lsof | grep "/path"
4. Lists the files that were opened under a user
#lsof-U Nobody
#lsof-U nobody,root
5, list the files that are opened under a process
#lsof-C httpd
#lsof-C httpd-c mysqld
6, compound query (OR) is opened file information
#lsof-U nobody-c httpd
7, compound query (and) is opened file information
#lsof-U root-c httpd
8. View open files for all users except root
#lsof-U ^root
9. View the open files of the specific process PID
#lsof-P 10101
#lsof-P 10101,10102,10103
10, List all network connections
#lsof-I.
11, List all network TCP or UDP connections
#lsof-I. TCP
#lsof-I. UDP
12. View specific Network port information
#lsof-I: 80
#lsof-I. tcp:80
#lsof-I. udp:53
13. View all network connections under specific users
#lsof-U www-i
14. List NFS Files
#lsof-N
15. List UNIX Socket files
#lsof-U
16, List A file that describes the typeface associated with a specific file
#lsof-D 2
#lsof-D 0-2
#lsof-D Mem
0 1 2 = fd:standard input, output, and error
17, list the PID associated with all network connections
#lsof-T-I.
#kill-9 ' lsof-t-i ' = kill all process Use network
18, repeat lsof output
#lsof-R 1-a-U www-i
From:http://feedproxy.google.com/~r/blogspot/hpnk/~3/v-rlmhbivma/lsof.html
Here, if innodb_file_per_table = 1 and innodb_open_files = X, you can use the Lsof tool:lsof | grep-c "\.ibd$" to see how many .IBD files INNODB file is open, in MySQL, either show status or show ENGINE INNODB status cannot display this.
[Turn]lsof detailed
