Source From Here
Introduction
lsof stands for List Open Files. It is easy to remember lsof command if you think of it as “ls + of”, where ls stands for list, and of stands for open files. It is a command line utility which is used to list the information about the files that are opened by various processes. In unix, everything is a file, ( pipes, sockets, directories, devices, etc.). So by using lsof, you can get the information about any opened files.
Simply typing lsof will provide a list of all open files belonging to all active processes.
By default One file per line is displayed. Most of the columns are self explanatory. We will explain the details about couple of cryptic columns (FD and TYPE). FD – Represents the file descriptor. Some of the values of FDs are:
TYPE – Specifies the type of the file. Some of the values of TYPEs are,
For a complete list of FD & TYPE, refer man lsof.
Usage Examples
List processes which opened a specific file
You can list only the processes which opened a specific file, by providing the filename as arguments.
List opened files under a directory
You can list the processes which opened files under a specified directory using ‘+D’ option. +D will recurse the sub directories also. If you don’t want lsof to recurse, then use ‘+d’ option.
List opened files based on process names starting with
You can list the files opened by process names starting with a string, using ‘-c’ option. -c followed by the process name will list the files opened by the process starting with that processes name. Multiple -c is accepted.
List processes using a mount point
Sometime when we try to umount a directory, the system will say “Device or Resource Busy” error. So we need to find out what are all the processes using the mount point and kill those processes to umount the directory. By using lsofwe can find those processes.
List files opened by a specific user
In order to find the list of files opened by a specific users, use ‘-u’ option.
Sometimes you may want to list files opened by all users, expect some 1 or 2. In that case you can use the ‘^’ to exclude only the particular user as follows:
The above command listed all the files opened by all users, expect user ‘lakshmanan’.
List all open files by a specific process
You can list all the files opened by a specific process using ‘-p’ option. It will be helpful sometimes to get more information about a specific process.
Kill all process that belongs to a particular user
When you want to kill all the processes which has files opened by a specific user, you can use ‘-t’ option to list output only the process id of the process, and pass it to kill as follows:
The above command will kill all process belonging to user ‘lakshmanan’, which has files opened. Similarly you can also use ‘-t’ in many ways. For example, to list process id of a process which opened /var/log/syslog can be done by:
Talking about kill, did you know that there are 4 Ways to Kill a Process?
Combine more list options using OR/AND
By default when you use more than one list option in lsof, they will be ORed. For example:
The above command uses two list options, ‘-u’ and ‘-c’. So the command will list process belongs to user ‘lakshmanan’ as well as process name starts with ‘init’. But when you want to list a process belongs to user ‘lakshmanan’ and the process name starts with ‘init’, you can use ‘-a’ option.
The above command will not output anything, because there is no such process named ‘init’ belonging to user ‘lakshmanan’.
Execute lsof in repeat mode
lsof also support Repeat mode. It will first list files based on the given parameters, and delay for specified seconds and again list files based on the given parameters. It can be interrupted by a signal. Repeat mode can be enabled by using ‘-r’ or ‘+r’. If ‘+r’ is used then, the repeat mode will end when no open files are found. ‘-r’ will continue to list,delay,list until a interrupt is given irrespective of files are opened or not.
In the above output, for the first 5 seconds, there is no output. After that a script named “inita.sh” is started, and it list the output every 5 seconds.
Network connections are also files. So we can find information about them by using lsof.
List processes which are listening on a particular port
You can list the processes which are listening on a particular port by using ‘-i’ with ‘:’ as follows:
List all TCP or UDP connections
You can list all the TCP or UDP connections by specifying the protocol using ‘-i’.
List all Network File System ( NFS ) files
You can list all the NFS files by using ‘-N’ option. The following lsof command will list all NFS files used by user ‘lakshmanan’.
Introduction
lsof stands for List Open Files. It is easy to remember lsof command if you think of it as “ls + of”, where ls stands for list, and of stands for open files. It is a command line utility which is used to list the information about the files that are opened by various processes. In unix, everything is a file, ( pipes, sockets, directories, devices, etc.). So by using lsof, you can get the information about any opened files.
Simply typing lsof will provide a list of all open files belonging to all active processes.
By default One file per line is displayed. Most of the columns are self explanatory. We will explain the details about couple of cryptic columns (FD and TYPE). FD – Represents the file descriptor. Some of the values of FDs are:
TYPE – Specifies the type of the file. Some of the values of TYPEs are,
For a complete list of FD & TYPE, refer man lsof.
Usage Examples
List processes which opened a specific file
You can list only the processes which opened a specific file, by providing the filename as arguments.
List opened files under a directory
You can list the processes which opened files under a specified directory using ‘+D’ option. +D will recurse the sub directories also. If you don’t want lsof to recurse, then use ‘+d’ option.
List opened files based on process names starting with
You can list the files opened by process names starting with a string, using ‘-c’ option. -c followed by the process name will list the files opened by the process starting with that processes name. Multiple -c is accepted.
List processes using a mount point
Sometime when we try to umount a directory, the system will say “Device or Resource Busy” error. So we need to find out what are all the processes using the mount point and kill those processes to umount the directory. By using lsofwe can find those processes.
List files opened by a specific user
In order to find the list of files opened by a specific users, use ‘-u’ option.
Sometimes you may want to list files opened by all users, expect some 1 or 2. In that case you can use the ‘^’ to exclude only the particular user as follows:
The above command listed all the files opened by all users, expect user ‘lakshmanan’.
List all open files by a specific process
You can list all the files opened by a specific process using ‘-p’ option. It will be helpful sometimes to get more information about a specific process.
Kill all process that belongs to a particular user
When you want to kill all the processes which has files opened by a specific user, you can use ‘-t’ option to list output only the process id of the process, and pass it to kill as follows:
The above command will kill all process belonging to user ‘lakshmanan’, which has files opened. Similarly you can also use ‘-t’ in many ways. For example, to list process id of a process which opened /var/log/syslog can be done by:
Talking about kill, did you know that there are 4 Ways to Kill a Process?
Combine more list options using OR/AND
By default when you use more than one list option in lsof, they will be ORed. For example:
The above command uses two list options, ‘-u’ and ‘-c’. So the command will list process belongs to user ‘lakshmanan’ as well as process name starts with ‘init’. But when you want to list a process belongs to user ‘lakshmanan’ and the process name starts with ‘init’, you can use ‘-a’ option.
The above command will not output anything, because there is no such process named ‘init’ belonging to user ‘lakshmanan’.
Execute lsof in repeat mode
lsof also support Repeat mode. It will first list files based on the given parameters, and delay for specified seconds and again list files based on the given parameters. It can be interrupted by a signal. Repeat mode can be enabled by using ‘-r’ or ‘+r’. If ‘+r’ is used then, the repeat mode will end when no open files are found. ‘-r’ will continue to list,delay,list until a interrupt is given irrespective of files are opened or not.
In the above output, for the first 5 seconds, there is no output. After that a script named “inita.sh” is started, and it list the output every 5 seconds.
Network connections are also files. So we can find information about them by using lsof.
List processes which are listening on a particular port
You can list the processes which are listening on a particular port by using ‘-i’ with ‘:’ as follows:
List all TCP or UDP connections
You can list all the TCP or UDP connections by specifying the protocol using ‘-i’.
List all Network File System ( NFS ) files
You can list all the NFS files by using ‘-N’ option. The following lsof command will list all NFS files used by user ‘lakshmanan’.
This message was edited 32 times. Last update was at 15/03/2016 14:26:04
沒有留言:
張貼留言