linux lsof - list open files

shlamp

2014-10-17

【基本介绍】

lsof-listopenfiles

Itisacommandlineutilitywhichisusedtolisttheinformationaboutthefilesthatareopenedbyvariousprocesses.Inunix,everythingisafile,(pipes,sockets,directories,devices,etc.).Sobyusinglsof,youcangettheinformationaboutanyopenedfiles.所有的东西都是文件，lsof用来查看打开文件的进程

【参数介绍】

[root@pandaVM ~]# lsof | head -10
COMMAND     PID      USER   FD      TYPE             DEVICE  SIZE/OFF       NODE NAME
init          1      root  cwd       DIR                8,2      4096          2 /
init          1      root  rtd       DIR                8,2      4096          2 /
init          1      root  txt       REG                8,2    150352     130349 /sbin/init
init          1      root  mem       REG                8,2     65928     260653 /lib64/libnss_files-2.12.so
init          1      root  mem       REG                8,2   1926800     264737 /lib64/libc-2.12.so
init          1      root  mem       REG                8,2     93320     264762 /lib64/libgcc_s-4.4.7-20120601.so.1
init          1      root  mem       REG                8,2     47064     264739 /lib64/librt-2.12.so
init          1      root  mem       REG                8,2    145896     260719 /lib64/libpthread-2.12.so
init          1      root  mem       REG                8,2    268232     264740 /lib64/libdbus-1.so.3.4.0

FD–Representsthefiledescriptor.（文件描述）SomeofthevaluesofFDsare,

cwd–CurrentWorkingDirectory

txt–Textfile

mem–Memorymappedfile

mmap–Memorymappeddevice

NUMBER–Representtheactualfiledescriptor.Thecharacterafterthenumberi.e’1u’,representsthemodeinwhichthefileisopened.rforread,wforwrite,uforreadandwrite.

TYPE–Specifiesthetypeofthefile.（文件类型）SomeofthevaluesofTYPEsare,

REG–RegularFile

DIR–Directory

FIFO–FirstInFirstOut

CHR–Characterspecialfile

lsoffilename显示打开指定文件的所有进程

lsof-a表示两个参数都必须满足时才显示结果

lsof-cstring显示COMMAND列中包含指定字符的进程所有打开的文件

lsof-uusername显示所属user进程打开的文件

lsof-ggid显示归属gid的进程情况

lsof+d/DIR/显示目录下被进程打开的文件

lsof+D/DIR/同上，但是会搜索目录下的所有目录，时间相对较长

lsof-dFD显示指定文件描述符的进程

lsof-n不将IP转换为hostname，缺省是不加上-n参数

lsof-i:port显示使用端口的进程

【常用例子】

Listprocesseswhichopenedaspecificfile（显示打开指定文件的进程）

# lsof /var/log/syslog

COMMAND  PID   USER   FD   TYPE DEVICE SIZE/OFF   NODE NAME
rsyslogd 488 syslog    1w   REG    8,1     1151 268940 /var/log/syslog

Listallopenfilesbyaspecificprocess（显示指定进程IP）

# lsof -p 1753

COMMAND  PID       USER   FD   TYPE DEVICE SIZE/OFF    NODE NAME
bash    1753 lakshmanan  cwd    DIR    8,1     4096  393571 /home/lakshmanan/test.txt
bash    1753 lakshmanan  rtd    DIR    8,1     4096       2 /
bash    1753 lakshmanan  255u   CHR  136,0      0t0       3 /dev/pts/0

Listprocesseswhicharelisteningonaparticularport（显示指定端口）

# lsof -i :25

COMMAND  PID        USER   FD   TYPE DEVICE SIZE NODE NAME
exim4   2541 Debian-exim    3u  IPv4   8677       TCP localhost:smtp (LISTEN)

Listfilesopenedbyaspecificuser（显示指定用户的进程）

# lsof -u lakshmanan

COMMAND    PID       USER   FD   TYPE     DEVICE SIZE/OFF       NODE NAME
update-no 1892 lakshmanan   20r  FIFO        0,8      0t0      14536 pipe
update-no 1892 lakshmanan   21w  FIFO        0,8      0t0      14536 pipe
bash      1995 lakshmanan  cwd    DIR        8,1     4096     393218 /home/lakshmanan

Listopenedfilesbasedonprocessnamesstartingwith（显示指定进程名）

# lsof -c ssh -c init

COMMAND    PID   USER   FD   TYPE DEVICE SIZE/OFF   NODE NAME
init         1       root  txt    REG        8,1   124704  917562 /sbin/init
init         1       root  mem    REG        8,1  1434180 1442625 /lib/i386-linux-gnu/libc-2.13.so
init         1       root  mem    REG        8,1    30684 1442694 /lib/i386-linux-gnu/librt-2.13.so
...
ssh-agent 1528 lakshmanan    1u   CHR        1,3      0t0    4369 /dev/null
ssh-agent 1528 lakshmanan    2u   CHR        1,3      0t0    4369 /dev/null
ssh-agent 1528 lakshmanan    3u  unix 0xdf70e240      0t0   10464 /tmp/ssh-sUymKXxw

Listopenedfilesunderadirectory(显示目录下被打开的文件)

# lsof +D /var/log/

COMMAND   PID   USER  FD   TYPE DEVICE SIZE/OFF   NODE NAME
rsyslogd  488 syslog   1w   REG    8,1     1151 268940 /var/log/syslog
rsyslogd  488 syslog   2w   REG    8,1     2405 269616 /var/log/auth.log
console-k 144   root   9w   REG    8,1    10871 269369 /var/log/ConsoleKit/history

【参考引用】

http://blog.csdn.net/guoguo1980/article/details/2324454

http://www.thegeekstuff.com/2012/08/lsof-command-examples/

lsof linux系统 root mem