每天進步一點點- lsof 命令尋找指定使用者、進程、連接埠開啟的檔案

    lsof 需要root許可權執行

先執行下面代碼供測試：

public class TestSleep {        public static void main(String[] args) {                System.out.println("being sleep"+new Date().toLocaleString());                try                {                Runtime rt = Runtime.getRuntime();                Process proc = rt.exec("/home/boco/script/sleep.sh");                InputStream stdin = proc.getInputStream();                InputStreamReader isr = new InputStreamReader(stdin);                BufferedReader br = new BufferedReader(isr);                String line = null;                System.out.println("<output></output>");                while ( (line = br.readLine()) != null)                System.out.println(line);                System.out.println("");                int exitVal = proc.waitFor();                System.out.println("Process exitValue: " + exitVal);                } catch (Throwable t)                {                t.printStackTrace();                }                System.out.println("end sleep"+new Date().toLocaleString());        }}

 

#!/bin/bash#/home/boco/script/sleep.shecho "begin"sleep 1000echo "end"

 

1、尋找所有開啟的檔案

[root@redhat5 ~]# lsof | headCOMMAND    PID      USER   FD      TYPE     DEVICE     SIZE       NODE NAMEinit         1      root  cwd       DIR        8,3     4096          2 /init         1      root  rtd       DIR        8,3     4096          2 /init         1      root  txt       REG        8,3    38652    4484999 /sbin/initinit         1      root  mem       REG        8,3   125736     492620 /lib/ld-2.5.soinit         1      root  mem       REG        8,3  1611564     492621 /lib/libc-2.5.soinit         1      root  mem       REG        8,3    16428     492622 /lib/libdl-2.5.soinit         1      root  mem       REG        8,3    93508     492636 /lib/libselinux.so.1init         1      root  mem       REG        8,3   245376     492635 /lib/libsepol.so.1init         1      root   10u     FIFO       0,17                1506 /dev/initctl  

 

FD - File descriptor

FD 列包含這樣一些值

cwd - Current working directorytxt - Text filemem - Memory Mapped filemmap - Memory Mapped deviceNumber - It represent the actual file descriptor. For example, 0u, 1w and 3rr 是讀的意思，w 是寫，u 代表讀寫 

Type 代表檔案類型，例如：

>REG - Regular file >DIR - Directory>CHR - Character special file>FIFO - First in first out 

2、尋找使用者開啟的檔案

[root@redhat5 ~]# lsof -u bocoCOMMAND   PID USER   FD   TYPE DEVICE     SIZE    NODE NAMEbash     3599 boco  cwd    DIR    8,3     4096  752939 /home/boco/scriptbash     3599 boco  rtd    DIR    8,3     4096       2 /bash     3599 boco  txt    REG    8,3   735004 3306367 /bin/bashbash     3599 boco  mem    REG    8,3   125736  492620 /lib/ld-2.5.sobash     3599 boco  mem    REG    8,3  1611564  492621 /lib/libc-2.5.sobash     3599 boco  mem    REG    8,3    16428  492622 /lib/libdl-2.5.sobash     3599 boco  mem    REG    8,3    13276  492642 /lib/libtermcap.so.2.0.8bash     3599 boco  mem    REG    8,3    46680  491080 /lib/libnss_files-2.5.sobash     3599 boco  mem    REG    8,3    25462 2588743 /usr/lib/gconv/gconv-modules.cachebash     3599 boco  mem    REG    8,3 56452288 2492259 /usr/lib/locale/locale-archivebash     3599 boco    0u   CHR  136,0                2 /dev/pts/0bash     3599 boco    1u   CHR  136,0                2 /dev/pts/0bash     3599 boco    2u   CHR  136,0                2 /dev/pts/0bash     3599 boco  255u   CHR  136,0                2 /dev/pts/0java     3707 boco  cwd    DIR    8,3     4096  752939 /home/boco/scriptjava     3707 boco  rtd    DIR    8,3     4096       2 /java     3707 boco  txt    REG    8,3    47308 3404707 /usr/local/jdk1.6.0_45/bin/javajava     3707 boco  mem    REG    8,3   125736  492620 /lib/ld-2.5.sojava     3707 boco  mem    REG    8,3  1611564  492621 /lib/libc-2.5.sojava     3707 boco  mem    REG    8,3   208352  492627 /lib/libm-2.5.sojava     3707 boco  mem    REG    8,3    16428  492622 /lib/libdl-2.5.sojava     3707 boco  mem    REG    8,3   129716  492623 /lib/libpthread-2.5.sojava     3707 boco  mem    REG    8,3    44060  492624 /lib/librt-2.5.sojava     3707 boco  mem    REG    8,3   101404  492632 /lib/libnsl-2.5.sojava     3707 boco  mem    REG    8,3 15032320 3178121 /usr/local/jdk1.6.0_45/jre/lib/i386/client/classes.jsajava     3707 boco  mem    REG    8,3 52557932 2983708 /usr/local/jdk1.6.0_45/jre/lib/rt.jarjava     3707 boco  mem    REG    8,3    77119 3114849 /usr/local/jdk1.6.0_45/jre/lib/i386/libzip.sojava     3707 boco  mem    REG    8,3    46680  491080 /lib/libnss_files-2.5.sojava     3707 boco  mem    REG    8,3    32768  327367 /tmp/hsperfdata_boco/3707java     3707 boco  mem    REG    8,3   189222 3114847 /usr/local/jdk1.6.0_45/jre/lib/i386/libjava.sojava     3707 boco  mem    REG    8,3  6450682 3178118 /usr/local/jdk1.6.0_45/jre/lib/i386/client/libjvm.sojava     3707 boco  mem    REG    8,3    38142 3277888 /usr/local/jdk1.6.0_45/jre/lib/i386/jli/libjli.sojava     3707 boco  mem    REG    8,3    56701 3114846 /usr/local/jdk1.6.0_45/jre/lib/i386/libverify.sojava     3707 boco    0u   CHR  136,0                2 /dev/pts/0java     3707 boco    1u   CHR  136,0                2 /dev/pts/0java     3707 boco    2u   CHR  136,0                2 /dev/pts/0java     3707 boco    3r   REG    8,3 52557932 2983708 /usr/local/jdk1.6.0_45/jre/lib/rt.jarjava     3707 boco    5w  FIFO    0,6            15657 pipejava     3707 boco    6r  FIFO    0,6            15658 pipejava     3707 boco    8r  FIFO    0,6            15659 pipesleep.sh 3717 boco  cwd    DIR    8,3     4096  752939 /home/boco/scriptsleep.sh 3717 boco  rtd    DIR    8,3     4096       2 /sleep.sh 3717 boco  txt    REG    8,3   735004 3306367 /bin/bashsleep.sh 3717 boco  mem    REG    8,3   125736  492620 /lib/ld-2.5.sosleep.sh 3717 boco  mem    REG    8,3  1611564  492621 /lib/libc-2.5.sosleep.sh 3717 boco  mem    REG    8,3    16428  492622 /lib/libdl-2.5.sosleep.sh 3717 boco  mem    REG    8,3    13276  492642 /lib/libtermcap.so.2.0.8sleep.sh 3717 boco    0r  FIFO    0,6            15657 pipesleep.sh 3717 boco    1w  FIFO    0,6            15658 pipesleep.sh 3717 boco    2w  FIFO    0,6            15659 pipesleep.sh 3717 boco  255r   REG    8,3       47  752964 /home/boco/script/sleep.shsleep    3718 boco  cwd    DIR    8,3     4096  752939 /home/boco/scriptsleep    3718 boco  rtd    DIR    8,3     4096       2 /sleep    3718 boco  txt    REG    8,3    19564 3306437 /bin/sleepsleep    3718 boco  mem    REG    8,3   125736  492620 /lib/ld-2.5.sosleep    3718 boco  mem    REG    8,3  1611564  492621 /lib/libc-2.5.sosleep    3718 boco    0r  FIFO    0,6            15657 pipesleep    3718 boco    1w  FIFO    0,6            15658 pipesleep    3718 boco    2w  FIFO    0,6            15659 pipe  

 

 3、 列出在某個連接埠啟動並執行進程

[root@redhat5 ~]# lsof -i:23COMMAND  PID USER   FD   TYPE DEVICE SIZE NODE NAMExinetd  3309 root    5u  IPv4  12942       TCP *:telnet (LISTEN)telnetd 3597 root    0u  IPv4  14212       TCP localhost:telnet->localhost:49887 (ESTABLISHED)telnetd 3597 root    1u  IPv4  14212       TCP localhost:telnet->localhost:49887 (ESTABLISHED)telnetd 3597 root    2u  IPv4  14212       TCP localhost:telnet->localhost:49887 (ESTABLISHED)[root@redhat5 ~]# lsof -i:22COMMAND  PID USER   FD   TYPE DEVICE SIZE NODE NAMEsshd    3257 root    3u  IPv6  12673       TCP *:ssh (LISTEN)

 4、 列出連接埠在 22-23 之間的所有進程

[root@redhat5 ~]# lsof -i:22-23COMMAND  PID USER   FD   TYPE DEVICE SIZE NODE NAMEsshd    3257 root    3u  IPv6  12673       TCP *:ssh (LISTEN)xinetd  3309 root    5u  IPv4  12942       TCP *:telnet (LISTEN)telnetd 3597 root    0u  IPv4  14212       TCP localhost:telnet->localhost:49887 (ESTABLISHED)telnetd 3597 root    1u  IPv4  14212       TCP localhost:telnet->localhost:49887 (ESTABLISHED)telnetd 3597 root    2u  IPv4  14212       TCP localhost:telnet->localhost:49887 (ESTABLISHED) 

 5、只列出使用 IPv4 的開啟檔案

[root@redhat5 ~]# lsof -i 4COMMAND    PID  USER   FD   TYPE DEVICE SIZE NODE NAMEdhclient  2747  root    4u  IPv4   9709       UDP *:bootpcportmap   2876   rpc    3u  IPv4  10060       UDP *:sunrpcportmap   2876   rpc    4u  IPv4  10061       TCP *:sunrpc (LISTEN)rpc.statd 2916  root    3u  IPv4  10196       UDP *:975rpc.statd 2916  root    6u  IPv4  10183       UDP *:972rpc.statd 2916  root    7u  IPv4  10209       TCP *:978 (LISTEN)hpiod     3220  root    0u  IPv4  12562       TCP redhat5.4-baby:2208 (LISTEN)python    3225  root    4u  IPv4  12582       TCP redhat5.4-baby:2207 (LISTEN)cupsd     3272  root    4u  IPv4  12754       TCP redhat5.4-baby:ipp (LISTEN)cupsd     3272  root    6u  IPv4  12757       UDP *:ippxinetd    3309  root    5u  IPv4  12942       TCP *:telnet (LISTEN)sendmail  3333  root    4u  IPv4  12940       TCP redhat5.4-baby:smtp (LISTEN)avahi-dae 3467 avahi   13u  IPv4  13585       UDP *:mdnsavahi-dae 3467 avahi   15u  IPv4  13587       UDP *:36306telnetd   3597  root    0u  IPv4  14212       TCP localhost:telnet->localhost:49887 (ESTABLISHED)telnetd   3597  root    1u  IPv4  14212       TCP localhost:telnet->localhost:49887 (ESTABLISHED)telnetd   3597  root    2u  IPv4  14212       TCP localhost:telnet->localhost:49887 (ESTABLISHED)

 6、只列出使用 IPv6 的開啟檔案

[root@redhat5 ~]# lsof -i 6COMMAND    PID  USER   FD   TYPE DEVICE SIZE NODE NAMEsshd      3257  root    3u  IPv6  12673       TCP *:ssh (LISTEN)avahi-dae 3467 avahi   14u  IPv6  13586       UDP *:mdnsavahi-dae 3467 avahi   16u  IPv6  13588       UDP *:38402

 7、根據進程pid列出開啟的檔案

[root@redhat5 ~]# lsof -p 3707COMMAND  PID USER   FD   TYPE DEVICE     SIZE    NODE NAMEjava    3707 boco  cwd    DIR    8,3     4096  752939 /home/boco/scriptjava    3707 boco  rtd    DIR    8,3     4096       2 /java    3707 boco  txt    REG    8,3    47308 3404707 /usr/local/jdk1.6.0_45/bin/javajava    3707 boco  mem    REG    8,3   125736  492620 /lib/ld-2.5.sojava    3707 boco  mem    REG    8,3  1611564  492621 /lib/libc-2.5.sojava    3707 boco  mem    REG    8,3   208352  492627 /lib/libm-2.5.sojava    3707 boco  mem    REG    8,3    16428  492622 /lib/libdl-2.5.sojava    3707 boco  mem    REG    8,3   129716  492623 /lib/libpthread-2.5.sojava    3707 boco  mem    REG    8,3    44060  492624 /lib/librt-2.5.sojava    3707 boco  mem    REG    8,3   101404  492632 /lib/libnsl-2.5.sojava    3707 boco  mem    REG    8,3 15032320 3178121 /usr/local/jdk1.6.0_45/jre/lib/i386/client/classes.jsajava    3707 boco  mem    REG    8,3 52557932 2983708 /usr/local/jdk1.6.0_45/jre/lib/rt.jarjava    3707 boco  mem    REG    8,3    77119 3114849 /usr/local/jdk1.6.0_45/jre/lib/i386/libzip.sojava    3707 boco  mem    REG    8,3    46680  491080 /lib/libnss_files-2.5.sojava    3707 boco  mem    REG    8,3    32768  327367 /tmp/hsperfdata_boco/3707java    3707 boco  mem    REG    8,3   189222 3114847 /usr/local/jdk1.6.0_45/jre/lib/i386/libjava.sojava    3707 boco  mem    REG    8,3  6450682 3178118 /usr/local/jdk1.6.0_45/jre/lib/i386/client/libjvm.sojava    3707 boco  mem    REG    8,3    38142 3277888 /usr/local/jdk1.6.0_45/jre/lib/i386/jli/libjli.sojava    3707 boco  mem    REG    8,3    56701 3114846 /usr/local/jdk1.6.0_45/jre/lib/i386/libverify.sojava    3707 boco    0u   CHR  136,0                2 /dev/pts/0java    3707 boco    1u   CHR  136,0                2 /dev/pts/0java    3707 boco    2u   CHR  136,0                2 /dev/pts/0java    3707 boco    3r   REG    8,3 52557932 2983708 /usr/local/jdk1.6.0_45/jre/lib/rt.jarjava    3707 boco    5w  FIFO    0,6            15657 pipejava    3707 boco    6r  FIFO    0,6            15658 pipejava    3707 boco    8r  FIFO    0,6            15659 pipe

 8、根據進程名稱列出開啟的檔案

[root@redhat5 ~]# lsof -c javaCOMMAND  PID USER   FD   TYPE DEVICE     SIZE    NODE NAMEjava    3707 boco  cwd    DIR    8,3     4096  752939 /home/boco/scriptjava    3707 boco  rtd    DIR    8,3     4096       2 /java    3707 boco  txt    REG    8,3    47308 3404707 /usr/local/jdk1.6.0_45/bin/javajava    3707 boco  mem    REG    8,3   125736  492620 /lib/ld-2.5.sojava    3707 boco  mem    REG    8,3  1611564  492621 /lib/libc-2.5.sojava    3707 boco  mem    REG    8,3   208352  492627 /lib/libm-2.5.sojava    3707 boco  mem    REG    8,3    16428  492622 /lib/libdl-2.5.sojava    3707 boco  mem    REG    8,3   129716  492623 /lib/libpthread-2.5.sojava    3707 boco  mem    REG    8,3    44060  492624 /lib/librt-2.5.sojava    3707 boco  mem    REG    8,3   101404  492632 /lib/libnsl-2.5.sojava    3707 boco  mem    REG    8,3 15032320 3178121 /usr/local/jdk1.6.0_45/jre/lib/i386/client/classes.jsajava    3707 boco  mem    REG    8,3 52557932 2983708 /usr/local/jdk1.6.0_45/jre/lib/rt.jarjava    3707 boco  mem    REG    8,3    77119 3114849 /usr/local/jdk1.6.0_45/jre/lib/i386/libzip.sojava    3707 boco  mem    REG    8,3    46680  491080 /lib/libnss_files-2.5.sojava    3707 boco  mem    REG    8,3    32768  327367 /tmp/hsperfdata_boco/3707java    3707 boco  mem    REG    8,3   189222 3114847 /usr/local/jdk1.6.0_45/jre/lib/i386/libjava.sojava    3707 boco  mem    REG    8,3  6450682 3178118 /usr/local/jdk1.6.0_45/jre/lib/i386/client/libjvm.sojava    3707 boco  mem    REG    8,3    38142 3277888 /usr/local/jdk1.6.0_45/jre/lib/i386/jli/libjli.sojava    3707 boco  mem    REG    8,3    56701 3114846 /usr/local/jdk1.6.0_45/jre/lib/i386/libverify.sojava    3707 boco    0u   CHR  136,0                2 /dev/pts/0java    3707 boco    1u   CHR  136,0                2 /dev/pts/0java    3707 boco    2u   CHR  136,0                2 /dev/pts/0java    3707 boco    3r   REG    8,3 52557932 2983708 /usr/local/jdk1.6.0_45/jre/lib/rt.jarjava    3707 boco    5w  FIFO    0,6            15657 pipejava    3707 boco    6r  FIFO    0,6            15658 pipejava    3707 boco    8r  FIFO    0,6            15659 pipe[root@redhat5 ~]#[root@redhat5 ~]# lsof | grep TestSleep[root@redhat5 ~]# jps3707 TestSleep3798 Jps

 9、只顯示pid

[root@redhat5 ~]# lsof -t -u boco3599370737173718

 10、列出所有偵聽和已建立的網路連接

[root@redhat5 ~]# lsof -iCOMMAND    PID  USER   FD   TYPE DEVICE SIZE NODE NAMEdhclient  2747  root    4u  IPv4   9709       UDP *:bootpcportmap   2876   rpc    3u  IPv4  10060       UDP *:sunrpcportmap   2876   rpc    4u  IPv4  10061       TCP *:sunrpc (LISTEN)rpc.statd 2916  root    3u  IPv4  10196       UDP *:975rpc.statd 2916  root    6u  IPv4  10183       UDP *:972rpc.statd 2916  root    7u  IPv4  10209       TCP *:978 (LISTEN)hpiod     3220  root    0u  IPv4  12562       TCP redhat5.4-baby:2208 (LISTEN)python    3225  root    4u  IPv4  12582       TCP redhat5.4-baby:2207 (LISTEN)sshd      3257  root    3u  IPv6  12673       TCP *:ssh (LISTEN)cupsd     3272  root    4u  IPv4  12754       TCP redhat5.4-baby:ipp (LISTEN)cupsd     3272  root    6u  IPv4  12757       UDP *:ippxinetd    3309  root    5u  IPv4  12942       TCP *:telnet (LISTEN)sendmail  3333  root    4u  IPv4  12940       TCP redhat5.4-baby:smtp (LISTEN)avahi-dae 3467 avahi   13u  IPv4  13585       UDP *:mdnsavahi-dae 3467 avahi   14u  IPv6  13586       UDP *:mdnsavahi-dae 3467 avahi   15u  IPv4  13587       UDP *:36306avahi-dae 3467 avahi   16u  IPv6  13588       UDP *:38402telnetd   3597  root    0u  IPv4  14212       TCP localhost:telnet->localhost:49887 (ESTABLISHED)telnetd   3597  root    1u  IPv4  14212       TCP localhost:telnet->localhost:49887 (ESTABLISHED)telnetd   3597  root    2u  IPv4  14212       TCP localhost:telnet->localhost:49887 (ESTABLISHED)