Tag Info

Hot answers tagged

15

netstat -lnp will list the pid and process name next to each listening port. This will work under Linux, but not all others (like AIX.) Add -t if you want TCP only. # netstat -lntp Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 0.0.0.0:24800 ...


13

Running it with strace -e trace=open,close,read,write,connect,accept your-command-here would probably be sufficient. You'll need to use the -o option to put strace's output somewhere other than the console, if the process can print to stderr. If your process forks, you'll also need -f or -ff. Oh, and you might want -t as well, so you can see when the ...


13

According to the author of lsof, it's impossible to find this out: the Linux kernel does not expose this information. Source: 2003 thread on comp.unix.admin. The number shown in /proc/$pid/fd/$fd is the socket's inode number in the virtual socket filesystem. When you create a pipe or socket pair, each end successively receives an inode number. The numbers ...


8

As recommended by IBM: use lsof -i -n and look for port XY. If you want parseable output from lsof, use the -F flag and parse the output with awk. You can get pre-compiled binaries for AIX V5. I don't know if there are pre-compiled binaries for V6; if there aren't, get the source and compile it.


6

When you use vi/vim to edit a file you aren't actually holding ~/<filename>open you are reading the file into ~/.<filename>.swp and then holding that temp file open. If you run lsof ~/.<filename>.swp it will show you the information you are looking for. NOTE: If you have multiple people editing the same file you will need to lsof ...


6

The Unix Rosetta Stone is a good resource for this kind of questions. It mentions a few alternatives for lsof (see below). Do not however that lsof is the de facto standard application for what it does. If all you want is to find the process ID(s) that have a particular file open, then you can use fuser on any POSIX-compliant system. On operating systems ...


6

One way is to say lsof -i:57010 -sTCP:ESTABLISHED. This walks the kernel's open file handle table looking for processes with an established TCP connection using that port. (Network sockets are file handles on *ix type systems.) You'd use -sTCP:LISTEN on the server side to filter out only the listener socket instead. Because of the way lsof works, it can ...


5

Information on the meanings of the columns can be found in the lsof(8) manpage. I will address the ones you are asking about specifically. cwd => current working directory 3r => file descriptor 3 opened for reading DIR => directory REG => regular file In order to unmount the drive, you will likely need to stop your webserver, and kill the ...


4

COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME webalizer 32342 ctxmortg 5uW REG 8,17 12288 32890954 /home2/ctxmortg/tmp/webalizer/eyebestdatedotcomauph.ctxmortgagemortgagerefi.com/dns_cache.db FD - File Descriptor If you are looking for file being written, look for following flag # - The number in front of flag(s) is the file ...


4

sudo lsof -iTCP -sTCP:LISTEN sudo lsof -iTCP -sTCP:LISTEN -P sudo lsof -iTCP -sTCP:LISTEN -P -n sudo lsof -iTCP -sTCP:LISTEN -n All return the same 32 entries (... | wc -l) on my heavily used Lion MBP. -P -n prevents lsof from doing name resolution, and it doesn't block. Missing either one of these, it can be very slow. For UDP: sudo lsof -iUDP -P -n ...


4

The short answer is: screen. The slightly longer answer is that the -m flag to fuser tells it to list everything using the mountpoint. Depending on your setup, that probably means all of /dev, but it could also be /. Clearly not what you intended. You'll get a very long list if you do fuser -vm /dev/ttyS0, over 60 lines on my system. Take off the -m and ...


4

The fourth column of lsof's output tells you that this directory is the current working directory (cwd) of the process. Most probably compton was started in this directory. Most probably you might kill the process and restart it in another directory (e.g. /). You might try forcing it to leave the directory with this hack: Attach a GDB to the process by ...


3

The usage of the two are different. For lsof, to show opened files for certain path only, put -- in front of each path lsof -- /home4 lsof -- /home4 -- /home2 lsof will show all opened file containing the path. For fuser, on the other hand, show process opening the file you specified fuser -uv <filename> To show processes accessing a ...


3

Try using netstat with rmsock. port=$1 addr=`netstat -Aan | grep $port | awk '{print $1}` pid=`rmsock $addr tcpcb | awk '{print $9}'` ps -ef | grep $pid For netstat, the -A shows the address of any protocol control blocks associated with the sockets, the -a option shows the state of all sockets including those of server processes, and the -n option gives ...


3

On AIX, netstat & rmsock can be used to determine process binding: [root@aix] netstat -Ana|grep LISTEN|grep 80 f100070000280bb0 tcp4 0 0 *.37 *.* LISTEN f1000700025de3b0 tcp 0 0 *.80 *.* LISTEN f1000700002803b0 tcp4 0 0 *.111 *.* LISTEN f1000700021b33b0 ...


3

A long running lsof process usually means that DNS resolution is timing out or not working correctly which is delaying the output of it. You can disable DNS resolution by adding the -n option. Of course you might want to check out why DNS resolution is taking too long on your server as well.


2

Another tool available on Linux is ss. From the ss man page on Fedora: NAME ss - another utility to investigate sockets SYNOPSIS ss [options] [ FILTER ] DESCRIPTION ss is used to dump socket statistics. It allows showing information similar to netstat. It can display more TCP and state informations than other tools. ...


2

For Solaris you can use pfiles and then grep by sockname: or port:. A sample (from here): pfiles `ptree | awk '{print $1}'` | egrep '^[0-9]|port:'


2

Types starting with V are virtual types. That is, there is no corresponding inode on any physical disk but only a vnode in a virtual filesystem (like /proc). It seems those types only belong to BSD-like systems (AIX, Darwin, FreeBSD, HPUX, Sun etc.) and won't occur on a Linux system. As with the non-virtual types, DIR stands for directory and REG for a ...


2

It is possible your VolGroup-lv_root is created on that drive. Check output of following command pvs It display physical volumes information about LV. More info about LVM (1), (2), (3)


2

Since you have not given any information on where you see this I will assume you are running GNU lsof with no arguments and you see 0t0 in the SIZE/OFF column. This, by default, shows the size of the file in question. However, for "special" files, it gives the offset instead. From the lsof man page: SIZE, SIZE/OFF, or OFFSET is the size of the file or ...


2

From the lsof FAQ: 17.12.7 Why does lsof on my Solaris 7, 8 or 9 system say, "can't read namelist from /dev/ksyms?" You're probably trying to use an lsof executable built for an earlier Solaris release on a 64 bit Solaris 7, 8 or 9 kernel. The output from lsof -v will tell you the build environment of your lsof executable. ...


2

Ultimately, the following command line appears to have solved the problem. I don't recall the original source (or command line) I had used, so I don't know if the documentation I was using was wrong or it was a problem with the mirror: svn checkout svn://svn.freebsd.org/base/release/9.2.0/ /usr/src


2

Look at the FD column values in the output of lsof. For example: sudo lsof +d /foo The manpages describe the interpretation; 'r' for read; 'w' for write' and 'u' for read and write access. This can easily be used to list the objects of interest: sudo lsof +d /foo | awk '/$4~/u/ {print $NF}'


2

I think you're correct in your logic that stat curr_connections is the number of connections that are current. curr_connections - Number of open connections to this Memcached server, should be the same value on all servers during normal operation. This is something like the count of mySQL's "SHOW PROCESSLIST" result rows. Source: Memcached statistics ...


2

To check which programs is listening on a port. The command netstat has options to show listened ports and programs/pids, I usually disable DNS look up as well. netstat -nlp or just tcp ports netstat -nltp man netstat for further reading and all options.


1

When I tried to execute gammu-smsd as a daemon, my syslog (which the daemon writes to) indicated that the /dev/ttyS0 port was currently open and in use. So in order to figure out what was using it, I initially ran fuser -m -u /dev/ttyS0 However, that -m switch gave a deceptive response because as @derobert said it lists everything using the mountpoint. ...


1

You can do it this way using virsh along with some scripting: $ for i in `virsh list | awk '{print $2}' | egrep -v "^$|Name"`; do printf "%-14s:%s\n" $i $(virsh ttyconsole $i | grep -v "^$"); done cobbler :/dev/pts/1 xwiki :/dev/pts/3 fan :/dev/pts/4 mercury :/dev/pts/5 mungr :/dev/pts/0 win2008R2-01 ...


1

Change your downloading script to download files to a temporary name or directory, then move the result when the downloading is finished. This is more robust than trying to detect that wget is still working; in particular, if wget is interrupted (e.g. by a reboot), you won't risk mistaking a partial file for a complete download. Also, be sure to test the ...


1

You can use fuser, or lsof. fuser foo.zip The output looks like so: $ fuser archlinux-2013.02.01-dual.iso /home/chris/archlinux-2013.02.01-dual.iso: 22506 $ awk -F'\0' '{ print $1 }' /proc/22506/cmdline wget



Only top voted, non community-wiki answers of a minimum length are eligible