lsof is a tool to list open files of processes

learn more… | top users | synonyms

0
votes
3answers
81 views

How to delete huge files from linux

I've been facing an issue that while using lsof | grep deleted command, I got the following result: sendmail 11633 smmsp 3uW REG 8,7 329818112 8119977 ...
1
vote
3answers
27 views

separate lsof output by column

I am using this command below and trying to separate the columns I only want to get the PID to use it in my python script. I can easily get this line by line but then how to separate into columns in ...
0
votes
1answer
58 views

df reports 100% full filesystem, du shows only 25% used even though there's no unlinked file [duplicate]

I have strange issue, df shows rootfs is 100% full but du shows it's 25% used. So I check on the unlinked files from the rootfs using lsof +aL1 / and it does not show me any deleted/unlinked files ...
0
votes
3answers
84 views

How to display size “human-readable” in lsof | grep /var* [duplicate]

I am currently trying to see , all the files which are using /var mount. With lsof | grep /var* when Its displaying size in bytes. How can I display file size in MB. Thank you.
2
votes
3answers
119 views

lsof -p PID vs lsof | grep PID

I do not understand the ouput of the lsof command. When i write lsof -p PID I get 4 lines and when I write lsof | grep PID I get hundreds of lines. Shouldn't it return the same result? ...
2
votes
3answers
155 views

How to iterate through files and delete those older than x days but NOT in use

So, I've been able to figure out bits of this myself but am having trouble piecing them together. I have a task I need to automate - I have folders filled with gigabytes of obsolete files, and I want ...
-3
votes
1answer
47 views

Why do “lsof -u USER” and “lsof | grep USER” return different results? [closed]

On my system: root@NOTIFICATION:/# lsof | wc -l 24187 root@NOTIFICATION:/# lsof -u tomcat7 | wc -l 224 root@NOTIFICATION:/# lsof | grep tomcat7 | wc -l 20646
1
vote
1answer
21 views

Do `lsof` listings include unsynced/delayed writes?

As a follow up to an answer about unsynced files i was wondering if lsof counts delayed writes as open files? If an application has closed a file, but the file is not yet physically on the device, ...
3
votes
1answer
39 views

How to call lsof properly to retrieve all TCP connections?

# lsof -n -itcp | wc 92 919 10212 # lsof -n | grep TCP | wc 2482 27222 373861 What I'm doing wrong with lsof -itcp ? Such calling is skipping part of connections, looks like this ...
-1
votes
1answer
122 views

du -sh and df -h are giving different output [duplicate]

I got an alert stating that 3 of my mount points are 91 % full and i need to clear the files. When I run df -h command it states that the mount points are 91% full but when i try to run du -sh * in ...
3
votes
1answer
193 views

Should I be concerned with large (deleted) files in lsof? [duplicate]

We've been working to clean up some space in our /opt mount. A large culprit of space consumption was log files for some processes we run (to the tune of 2 to 12 GB each). We've cleaned these up by ...
1
vote
1answer
88 views

Why lsof reports a higher number of open files of user than what ulimit says should be allowed?

I have checked the result for user kpiserv [kpiserv@***** ~]$ lsof -u kpiserv |wc -l 5358 [kpiserv@***** ~]$ ulimit -a open files (-n) 1024 Why lsof reports a ...
3
votes
1answer
101 views

How does `lsof` keep track of open file descriptors' filenames?

I've noticed, if a file is renamed, lsof displays the new name. To test it out, created a python script: #!/bin/python import time f = open('foo.txt', 'w') while True: time.sleep(1) Saw that ...
0
votes
1answer
53 views

More succinct alternative to “lsof -p $(pidof postgres| sed -r 's/ /,/g')”

pidof returns a space separated list of pids. lsof -p requires a comma serparated one. This can be solved with sed via: lsof -p `pidof postgres| sed -r 's/ /,/g'` However, the extra pipe seems a ...
0
votes
1answer
87 views

lsof vs cat/proc/…/maps [closed]

While looking for a detection method for services that would need to be rstarted after patching OpenSSL, I stumbled over a difference between the return of those 2 commands : [root@host ~]# cat ...
2
votes
2answers
294 views

Mac drive in use, understanding lsof

I am trying to repair permissions on my external HD. I cannot empty my trash when it is plugged in, because I get a bunch of "such file is in use". I read online that this might be resolved by ...
2
votes
2answers
349 views

How to use lsof to identify incoming TCP connections?

I want to know if my server establishes a connection to a remote server or if the remote server tries to reach my server. I tried to read the output of lsof and obtain this information: lsof -i ...
2
votes
1answer
89 views

What exactly is a file offset in lsof output?

I was using lsof to track down deleted files that were still taking up space and I realized that I wasn't quite sure what an offset is with respect to a file. lsof's man page was less than helpful in ...
3
votes
1answer
45 views

Get all files open for writing with pid, recursively

Given a pid, I can get all the files open for writing something like: lsof -p 28827 | awk '$4 ~ "[wW]"{print $(NF-1), $NF}' One of those ends up being a pipe: 28827 232611 pipe I want to look-up ...
3
votes
1answer
275 views

Command for killing specific PID provided by previous command

Sometimes I need to kill a process (the reasons why are not important). And I know I can find that process with the following command: lsof -i :8080, being my candidate the last process in the output ...
2
votes
1answer
133 views

Discrepancy with lsof command when trying to get the count of open files per process

I am trying to get a list of open files per process. I ran the following one-liner from PerlMonks: lsof | perl -lane '$x{"$F[0]:$F[1]"}++; END { print "$x{$_}\t$_" for sort {$x{$a}<=>$x{$b}} ...
3
votes
1answer
53 views

What is an 'executing text reference'?

In the lsof man page, there is the following sentence: An open file may be a regular file, a directory, a block special file, a character special file, an executing text reference, a library, a ...
1
vote
1answer
1k views

lsof: no pwd entry for UID

I'm trying to run command lsof |grep services on my Solaris 10 to find any processes that have big files which are using up the disk space but i got a bunch of lines saying: lsof: no pwd entry for ...
0
votes
1answer
98 views

Why can `lsof -i` not show an open connection which `netstat -n` lists?

A strange situation. I started telnet 0 8081 and lsof -i (run under root) doesn't list this connection, but netstat -n does. Why can this be?
0
votes
0answers
173 views

TCP connections in SYN_SENT not visible with lsof

I have lots of connections in SYN_SENT: $ conntrack -L | grep -c 'SYN_SENT' conntrack v1.2.1 (conntrack-tools): 28100 flow entries have been shown. 14017 But I can't see which process(es) are ...
3
votes
1answer
94 views

log PID of each connection attempt

Finding the PID of an established connection is trivial using netstat or lsof. However, I have a process which is creating a connection ever 60 seconds to our database and locking it up by maxing out ...
2
votes
1answer
372 views

lsof: measure I/O rate of a socket fd

I'm writing a script that parses the output of lsof to show a list of what processes have sockets open (similar to what netstat shows). lsof also gives me a file descriptor. What I want to do now is ...
2
votes
1answer
576 views

how to find out the full path of the command from the result of lsof -i

lsof is a great utility, just now started using it. lsof -i | grep smtp => this give the following result. httpd.pl 212548 global 3u IPv4 893092369 0t0 TCP ...
2
votes
0answers
2k views

File limits getrlimit(RLIMIT_NOFILE) failed

(32-bit system) Posted a Q/A earlier regarding Chrome crashing because of exhausted limit in open files. Chrome has since run more smooth, (after increasing limit), but still crashes from time to ...
5
votes
3answers
8k views

Best way to free disk space from deleted files that are held open

Hi I have many files that have been deleted but for some reason the disk space associated with the deleted files is unable to be utilized until I explicitly kill the process for the file taking the ...
0
votes
3answers
596 views

How do I detect running processes using a library package?

This command is doing the rounds for detecting currently running processes using glibc: lsof | grep libc | awk '{print $2}' | sort | uniq I find it intensely annoying, since /libc/ matches not only ...
2
votes
1answer
63 views

lsof misses files

Why does lsof fail to list files I have open. For example I open with the text editor some file in my home directory. $ gedit ~/.python_history lsof does not even work as root $ sudo lsof | grep ...
0
votes
1answer
82 views

Different output of lsof variant [closed]

I have a Java application utilizing the MongoDB Java driver (2.11.3). I'm using one static MongoClient instance across the whole application and as stated in the docs it should handle the connection ...
1
vote
0answers
207 views

Why doesn't syslog traffic show up in netstat and lsof output?

I've noticed on my CentOS 5.x system that outbound syslog traffic (UDP) doesn't show up in lsof or netstat results. I've even tried stuff like watch -n .1 'netstat -l -u -n --program' to make sure ...
6
votes
2answers
1k views

Move file but only if it's closed

I want to move large file created by external process as soon as it's closed. Is this test command correct? if lsof "/file/name" then # file is open, don't touch it! else if [ 1 -eq ...
2
votes
2answers
6k views

lsof: WARNING: can't stat() fuse.gvfsd-fuse file system

What exactly is happening here? root@bob-p7-1298c:/# ls -l /tmp/report.csv && lsof | grep "report.csv" -rw-r--r-- 1 mysql mysql 1430 Dec 4 12:34 /tmp/report.csv lsof: WARNING: can't stat() ...
2
votes
1answer
264 views

How do I figure out what is preventing a bind mount from unmounting?

I have a problem with a mountpoint being too busy to unmount. Normally, lsof or fuser would tell me what process is using it, but this is a bind mount, so lsof and fuser show what is using both the ...
1
vote
1answer
114 views

Failed to list directory contents: process waits infinitely

I use Linux Mint 13, and sometimes (rarely) I find myself not being able to list my home directory contents. When I try to do so: $ cd $ ls then, ls just waits indefinitely. The same with any other ...
2
votes
0answers
233 views

lsof: home folder is busy, but I never logged in as that user

I'm trying to run ecryptfs-migrate-home to encrypt my home folder, but the command keeps failing the open files check. Indeed, lsof +D "/home/will" shows the same in-use files as ...
2
votes
2answers
237 views

How to capture the port number from this `lsof -F` output using awk (or something better)?

I've got output coming from lsof -F that looks like this: p7646 g7646 R8300 csocat u1000 Labe f3 au l tIPv4 G0x80002;0x0 d640391 o0t0 PTCP n*:51352 TST=LISTEN TQR=0 TQS=0 I am trying to capture the ...
8
votes
1answer
3k views

Monitoring files continuously with lsof

Is there a way to make lsof work continuously to monitor every file that is being opened in real time? I don't know the name of the process. I want lsof to work continuously for a period of time ...
1
vote
2answers
85 views

List only commands with lsof

I tried with lsof -F c somefile But I get p1 cinit p231 cmountall p314 cupstart-udev-br p317 cudevd Instead of init mountall ... Any way to get just the command?
1
vote
2answers
126 views

How to determine the newly closed file within a continuous audit log rotation?

I am attempting to find the best way to determine when the second file (of a matching criteria) is created. The context is an audit log rotation. Given a directory where audit logs are created every ...
2
votes
0answers
171 views

ls does not show a hidden file (OS X)

I am using lsof to view the list of open files. One such file that it displays open is : Google 3864 malaykeshav 46u REG 1,1 470455334 32578671 ...
7
votes
2answers
1k views

FreeBSD 10 trace disk activity

Is there any way to find some process which is periodically writing to disk (according to hdd led) on FreeBSD 10 with ZFS (maybe turn ZFS into verbose logging mode)? lsof and other instantly ...
1
vote
1answer
40 views

Limiting readers on a pipe

I want to use a pipe to pass some security credential information from "process1" to another script. I only want authorized reader processes to be permitted to read the pipe. I am thinking I will ...
1
vote
2answers
2k views

how to get the stream URL of flash radio

I am listening to a radio stream (flash content in a browser). I want to play this stream directly with mplayer or the like. Doing lsof -ni shows me these two lines (among others): plugin-co 13248 ...
1
vote
1answer
126 views

run lsof in non-interactive mode

I need to write lsof output for several network ports into bash variable. Simple $(lsof -i :5555) doesn't work - lsof waits for quit command (Ctrl-C) every time I call it. I can't figure out how to ...
2
votes
1answer
39 views

Forcing compton to free directory

I often have trouble unnounting filesystems because compton is keeping a subdirectory open. Here is one line from lsof I have right now: compton 30043 valmi cwd DIR ...
2
votes
1answer
119 views

link count of deleted files

I am reading in man lsof that +L enables the listing of file link counts. A specification of the form "+L1" will select open files that have been unlinked. I don't understand why deleted files ...