lsof is a tool to list open files of processes

learn more… | top users | synonyms

27
votes
5answers
6k views

Who's got the other end of this unix socketpair?

I want to determine which process has the other end of a UNIX socket. Specifically, I'm asking about one that was created with socketpair(), though the problem is the same for any UNIX socket. I ...
27
votes
6answers
48k views

Determining what process is bound to a port

I know that using the command: lsof -i TCP (or some variant of parameters with lsof) I can determine which process is bound to a particular port. This is useful say if I'm trying to start ...
14
votes
1answer
5k views

How do I monitor opened files of a process in realtime?

I know I can view the open files of a process using lsof at that moment in time on my Linux machine. However, a process can open, alter and close a file so quickly that I won't be able to see it when ...
10
votes
3answers
39k views

Alternatives for “lsof” command?

In many cases "lsof" is not installed on the machines that with I have to work, but the "function" of lsof would be needed very much (ex. on AIX). :\ Are there any "lsof" like applications in the ...
10
votes
5answers
9k views

Under AIX, how can I get the full path of a program bound to a port?

Under Linux I can use netstat -tulpnw and ps, like so: # netstat -tulpnw | grep :53 tcp 0 0 127.0.0.1:53 0.0.0.0:* LISTEN 1482/named udp ...
9
votes
1answer
12k views

lsof and listening ports

I am trying to get all the processes listening for a network connection on Mac OS X. netstat does not have the -p option and I am trying with lsof lsof -i -sTCP:LISTEN gives me a fair list of ...
8
votes
2answers
926 views

lsof - age of file

The *nix command lsof gives you a list of open files. Is anyone aware of a way that would also list how long a particular file has been open? Either by using lsof or any other command. I'm using ...
6
votes
3answers
2k views

Faster alternatives to lsof

I want to extract the process id of a certain process in order to shut it down. The process is a local web server using a certain port (localhost:3000), and I am currently doing it like this to ...
6
votes
2answers
524 views

Move file but only if it's closed

I want to move large file created by external process as soon as it's closed. Is this test command correct? if lsof "/file/name" then # file is open, don't touch it! else if [ 1 -eq ...
6
votes
2answers
490 views

FreeBSD 10 trace disk activity

Is there any way to find some process which is periodically writing to disk (according to hdd led) on FreeBSD 10 with ZFS (maybe turn ZFS into verbose logging mode)? lsof and other instantly ...
5
votes
3answers
1k views

How can I know the process name which is opening a tcp port?

I have two linux servers. Let's say they are C and S. C is client of S On my S machine, I type. $ netstat -an | grep ESTABLISHED tcp 0 0 192.168.1.220:3306 C:57010 ...
5
votes
2answers
2k views

fuser vs lsof to check files in use

I've been getting some suggestions on how to figure out why my serial port is busy. Specifically, when I try to start gammu-smsd, it refuses to start on /dev/ttyS0 because it says that port is busy: ...
5
votes
1answer
898 views

Monitoring files continuously with lsof

Is there a way to make lsof work continuously to monitor every file that is being opened in real time? I don't know the name of the process. I want lsof to work continuously for a period of time ...
4
votes
3answers
2k views

How do I get a mapping of Pid to Port?

I have a process which I need to run on a specific port. I have started some other process on that port and I need to kill it. Unfortunately, I don't remember the name/pid of the other process so I ...
4
votes
1answer
191 views

lsof doesn't return files open by the same user

Consider this simple scenario: I open a text file ~/textfile.txt with vim in one terminal (tried with both edit and read-only modes). In a different terminal, I run /usr/sbin/lsof ~/textfile.txt ...
4
votes
1answer
714 views

What do GDIR, GREG, VDIR, VREG mean in lsof output

The lsof manpage says the following about the TYPE column. TYPE is the type of the node associated with the file - e.g., GDIR, GREG, VDIR, VREG, etc. Can someone please explain (or point ...
4
votes
1answer
428 views

How do I update lsof port on FreeBSD 9.2?

It threw errors about kernel sources missing. So, I looked and sure enough this box doesn't have them. The documentation I have says to install them via sysinstall. That failed both automatically ...
4
votes
3answers
521 views

How to tell if a file is being downloaded by wget?

I use wget to download files (most are zip files) automatically for me during the night. However, sometimes in the morning I find that a few files cannot be unzipped. I don't know why this is ...
3
votes
3answers
244 views

Best way to free disk space from deleted files that are held open

Hi I have many files that have been deleted but for some reason the disk space associated with the deleted files is unable to be utilized until I explicitly kill the process for the file taking the ...
3
votes
1answer
1k views

What's the difference between lsof and fuser -uvm

Both shows the number of files we're using. Yet they both shows different results. root@host [~]# lsof /home4 root@host [~]# lsof /home2 root@host [~]# lsof /home4 Then we got fuser -uvm /home4 ...
3
votes
1answer
44 views

What is an 'executing text reference'?

In the lsof man page, there is the following sentence: An open file may be a regular file, a directory, a block special file, a character special file, an executing text reference, a library, a ...
3
votes
1answer
849 views

Memcache 'stats' reports non-zero 'curr_connections' - but lsof shows no socket connections

Our memcache daemon reports non-zero 'curr_connections'... $ telnet memcache-server 11211 Escape character is '^]'. stats ... STAT curr_connections 12 ... ...and yet, lsof shows no socket ...
3
votes
1answer
42 views

log PID of each connection attempt

Finding the PID of an established connection is trivial using netstat or lsof. However, I have a process which is creating a connection ever 60 seconds to our database and locking it up by maxing out ...
3
votes
1answer
586 views

How can I figure out which pty's are from which qemu?

I'm running qemu's like this: $ sudo qemu -boot d -m 1024 \ -netdev tap,id=tap0 \ -device virtio-net-pci,netdev=tap0,id=vth0 \ -drive file=ubuntu.iso,media=cdrom,cache=none,if=ide \ -monitor pty \ ...
2
votes
3answers
10k views

How to interpret this output of lsof command?

root@host [/home2]# lsof /home2 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME php 3182 ctxmortg cwd DIR 8,17 4096 32858196 /home2/ctxmortg/public_html/hello php ...
2
votes
2answers
141 views

How to capture the port number from this `lsof -F` output using awk (or something better)?

I've got output coming from lsof -F that looks like this: p7646 g7646 R8300 csocat u1000 Labe f3 au l tIPv4 G0x80002;0x0 d640391 o0t0 PTCP n*:51352 TST=LISTEN TQR=0 TQS=0 I am trying to capture the ...
2
votes
1answer
36 views

Discrepancy with lsof command when trying to get the count of open files per process

I am trying to get a list of open files per process. I ran the following one-liner from PerlMonks: lsof | perl -lane '$x{"$F[0]:$F[1]"}++; END { print "$x{$_}\t$_" for sort {$x{$a}<=>$x{$b}} ...
2
votes
2answers
2k views

lsof: WARNING: can't stat() fuse.gvfsd-fuse file system

What exactly is happening here? root@bob-p7-1298c:/# ls -l /tmp/report.csv && lsof | grep "report.csv" -rw-r--r-- 1 mysql mysql 1430 Dec 4 12:34 /tmp/report.csv lsof: WARNING: can't stat() ...
2
votes
1answer
36 views

Forcing compton to free directory

I often have trouble unnounting filesystems because compton is keeping a subdirectory open. Here is one line from lsof I have right now: compton 30043 valmi cwd DIR ...
2
votes
1answer
71 views

link count of deleted files

I am reading in man lsof that +L enables the listing of file link counts. A specification of the form "+L1" will select open files that have been unlinked. I don't understand why deleted files ...
2
votes
1answer
65 views

Command for killing specific PID provided by previous command

Sometimes I need to kill a process (the reasons why are not important). And I know I can find that process with the following command: lsof -i :8080, being my candidate the last process in the output ...
2
votes
1answer
40 views

lsof misses files

Why does lsof fail to list files I have open. For example I open with the text editor some file in my home directory. $ gedit ~/.python_history lsof does not even work as root $ sudo lsof | grep ...
2
votes
2answers
805 views

lsof - debug the output information

I was going through the questions of this site. In this particular question, I see the command lsof being used to list the files that are open for a particular user. I ran the below command in my ...
2
votes
1answer
98 views

How do I figure out what is preventing a bind mount from unmounting?

I have a problem with a mountpoint being too busy to unmount. Normally, lsof or fuser would tell me what process is using it, but this is a bind mount, so lsof and fuser show what is using both the ...
2
votes
1answer
93 views

how to find out the full path of the command from the result of lsof -i

lsof is a great utility, just now started using it. lsof -i | grep smtp => this give the following result. httpd.pl 212548 global 3u IPv4 893092369 0t0 TCP ...
2
votes
0answers
137 views

lsof: home folder is busy, but I never logged in as that user

I'm trying to run ecryptfs-migrate-home to encrypt my home folder, but the command keeps failing the open files check. Indeed, lsof +D "/home/will" shows the same in-use files as ...
2
votes
0answers
129 views

ls does not show a hidden file (OS X)

I am using lsof to view the list of open files. One such file that it displays open is : Google 3864 malaykeshav 46u REG 1,1 470455334 32578671 ...
1
vote
2answers
2k views

lsof: show files open as read-write

When I try to remount a partition as read-only, I get an error /foo is busy. I can list all files open from /foo with lsof /foo but that does not show me whether files are open read-only or ...
1
vote
2answers
64 views

List only commands with lsof

I tried with lsof -F c somefile But I get p1 cinit p231 cmountall p314 cupstart-udev-br p317 cudevd Instead of init mountall ... Any way to get just the command?
1
vote
1answer
74 views

run lsof in non-interactive mode

I need to write lsof output for several network ports into bash variable. Simple $(lsof -i :5555) doesn't work - lsof waits for quit command (Ctrl-C) every time I call it. I can't figure out how to ...
1
vote
1answer
36 views

Limiting readers on a pipe

I want to use a pipe to pass some security credential information from "process1" to another script. I only want authorized reader processes to be permitted to read the pipe. I am thinking I will ...
1
vote
2answers
97 views

Tracking which files are used by program

I am looking for a way to track which files are used by program installer(InstallAnywhere). I cannot use lsof because as far as I know it works on active processes and I want a tool which will work ...
1
vote
1answer
303 views

iostat report huge writes to drives that's not even mounted

root@host [~]# fsck /home2 fsck from util-linux-ng 2.17.2 e2fsck 1.41.12 (17-May-2010) /dev/sdb1: clean, 6018617/91578368 files, 54524459/366284000 blocks root@host [~]# fsck /home4 fsck from ...
1
vote
1answer
178 views

lsof: no pwd entry for UID

I'm trying to run command lsof |grep services on my Solaris 10 to find any processes that have big files which are using up the disk space but i got a bunch of lines saying: lsof: no pwd entry for ...
1
vote
1answer
113 views

lsof: measure I/O rate of a socket fd

I'm writing a script that parses the output of lsof to show a list of what processes have sockets open (similar to what netstat shows). lsof also gives me a file descriptor. What I want to do now is ...
1
vote
1answer
67 views

Failed to list directory contents: process waits infinitely

I use Linux Mint 13, and sometimes (rarely) I find myself not being able to list my home directory contents. When I try to do so: $ cd $ ls then, ls just waits indefinitely. The same with any other ...
1
vote
1answer
222 views

How can I monitor if anybody (any process) access is certain file [duplicate]

Possible Duplicate: Access history of a file I know if a file is "being accessed" I can use lsof to see who (which process) is accessing it, but lsof is slow and heavy and I don't think I ...
1
vote
2answers
95 views

How to determine the newly closed file within a continuous audit log rotation?

I am attempting to find the best way to determine when the second file (of a matching criteria) is created. The context is an audit log rotation. Given a directory where audit logs are created every ...
1
vote
0answers
283 views

Information about the 1630/master app

When I run $ sudo netstat -a --programs | grep LISTENING | grep 1630 I will get this output. Do you know what good are processes running under this app name? Why they I running on my system and if ...
0
votes
2answers
2k views

“lsof: can't read namelist from /dev/ksyms” on Solaris

On Solaris, when I type the command lsof -l I encountered this error: lsof: can't read namelist from /dev/ksyms Anyone knows what this error means and how I can get open the list of open FD's ...