Tag Info

Hot answers tagged

26

netstat -lnp will list the pid and process name next to each listening port. This will work under Linux, but not all others (like AIX.) Add -t if you want TCP only. # netstat -lntp Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 0.0.0.0:24800 ...


16

Running it with strace -e trace=open,close,read,write,connect,accept your-command-here would probably be sufficient. You'll need to use the -o option to put strace's output somewhere other than the console, if the process can print to stderr. If your process forks, you'll also need -f or -ff. Oh, and you might want -t as well, so you can see when the ...


15

According to the author of lsof, it's impossible to find this out: the Linux kernel does not expose this information. Source: 2003 thread on comp.unix.admin. The number shown in /proc/$pid/fd/$fd is the socket's inode number in the virtual socket filesystem. When you create a pipe or socket pair, each end successively receives an inode number. The numbers ...


12

Try: netstat -nap | grep 7080


10

You can put a -n option to lsof and then it remove the DNS resolution, which can accelerate the display


9

Erkki Seppala actually has a tool that retrieves this information from the Linux kernel with gdb.. It's available here.


9

The Unix Rosetta Stone is a good resource for this kind of questions. It mentions a few alternatives for lsof (see below). Do not however that lsof is the de facto standard application for what it does. If all you want is to find the process ID(s) that have a particular file open, then you can use fuser on any POSIX-compliant system. On operating systems ...


9

From the lsof man page Lsof returns a one (1) if any error was detected, including the failure to locate command names, file names, Internet addresses or files, login names, NFS files, PIDs, PGIDs, or UIDs it was asked to list. If the -V option is specified, lsof will indicate the search items it failed to list. ...


8

One way is to say lsof -i:57010 -sTCP:ESTABLISHED. This walks the kernel's open file handle table looking for processes with an established TCP connection using that port. (Network sockets are file handles on *ix type systems.) You'd use -sTCP:LISTEN on the server side to filter out only the listener socket instead. Because of the way lsof works, it can ...


8

You can use netstat -anp | grep 57010 on server C. But this will only work if there isn't any firewall in between which is mapping port 57010 to a different one.


8

As recommended by IBM: use lsof -i -n and look for port XY. If you want parseable output from lsof, use the -F flag and parse the output with awk. You can get pre-compiled binaries for AIX V5. I don't know if there are pre-compiled binaries for V6; if there aren't, get the source and compile it.


7

Try netstat, I cannot say whether its faster or slower, however. netstat -tanp | awk '$4 ~ /:8443$/ {sub(/\/.*/, "", $7); print $7}' | sort -u


7

sudo lsof -iTCP -sTCP:LISTEN sudo lsof -iTCP -sTCP:LISTEN -P sudo lsof -iTCP -sTCP:LISTEN -P -n sudo lsof -iTCP -sTCP:LISTEN -n All return the same 32 entries (... | wc -l) on my heavily used Lion MBP. -P -n prevents lsof from doing name resolution, and it doesn't block. Missing either one of these, it can be very slow. For UDP: sudo lsof -iUDP -P -n ...


7

I know of fuser, see if is available on your system.


6

COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME webalizer 32342 ctxmortg 5uW REG 8,17 12288 32890954 /home2/ctxmortg/tmp/webalizer/eyebestdatedotcomauph.ctxmortgagemortgagerefi.com/dns_cache.db FD - File Descriptor If you are looking for file being written, look for following flag # - The number in front of flag(s) is the file ...


6

Information on the meanings of the columns can be found in the lsof(8) manpage. I will address the ones you are asking about specifically. cwd => current working directory 3r => file descriptor 3 opened for reading DIR => directory REG => regular file In order to unmount the drive, you will likely need to stop your webserver, and kill the ...


6

When you use vi/vim to edit a file you aren't actually holding ~/<filename>open you are reading the file into ~/.<filename>.swp and then holding that temp file open. If you run lsof ~/.<filename>.swp it will show you the information you are looking for. NOTE: If you have multiple people editing the same file you will need to lsof ...


5

If you happen to run Solaris, an alternative to lsof, which isn't installed by default and might choke on ZFS, is pfiles. eg: pfiles /proc/*


5

DTrace is able to report on vfs information in FreeBSD (as well as a raft of other probes). DTrace is enabled by default in the 10 kernel so all you need to do is load the module then run the dtrace script. Load the DTrace module kldload dtraceall Get the vfssnoop.d script from the FreeBSD forums. Run it: ./vfssnoop.d Watch the output for what is ...


4

On AIX, netstat & rmsock can be used to determine process binding: [root@aix] netstat -Ana|grep LISTEN|grep 80 f100070000280bb0 tcp4 0 0 *.37 *.* LISTEN f1000700025de3b0 tcp 0 0 *.80 *.* LISTEN f1000700002803b0 tcp4 0 0 *.111 *.* LISTEN f1000700021b33b0 ...


4

Just for the sake of completeness: Using ss from the new Linux networking utility tool-set (iproute2): ss -tp sport = :57010 dst 192.168.1.220


4

The usage of the two are different. For lsof, to show opened files for certain path only, put -- in front of each path lsof -- /home4 lsof -- /home4 -- /home2 lsof will show all opened file containing the path. For fuser, on the other hand, show process opening the file you specified fuser -uv <filename> To show processes accessing a ...


4

The short answer is: screen. The slightly longer answer is that the -m flag to fuser tells it to list everything using the mountpoint. Depending on your setup, that probably means all of /dev, but it could also be /. Clearly not what you intended. You'll get a very long list if you do fuser -vm /dev/ttyS0, over 60 lines on my system. Take off the -m and ...


4

Well, yes. The manpage on my Debian system says “When +L is followed by a number, only files having a link count less than that number will be listed.”


4

The fourth column of lsof's output tells you that this directory is the current working directory (cwd) of the process. Most probably compton was started in this directory. Most probably you might kill the process and restart it in another directory (e.g. /). You might try forcing it to leave the directory with this hack: Attach a GDB to the process by ...


4

Combine the two: awk -F: '/^n\*:/ {print $2}'


4

As an alternative approach, this is the perfect case for a pipe - the second process will process output from the first process as soon as it's available, rather than waiting for the full process to finish: process1 input_file.dat | process2 > output_file.dat Advantages: Much faster in general: Doesn't have to write to and read from disk (this can ...


4

The space is not immediately freed because the running process still has an open file handle to the just-deleted file. After all, if a process is still trying to use a file, you probably don't really want the kernel to get rid of it (the file). That might make the process a bit upset. The best (and only, so far as I know) way to free the space is do just ...


3

Try using netstat with rmsock. port=$1 addr=`netstat -Aan | grep $port | awk '{print $1}` pid=`rmsock $addr tcpcb | awk '{print $9}'` ps -ef | grep $pid For netstat, the -A shows the address of any protocol control blocks associated with the sockets, the -a option shows the state of all sockets including those of server processes, and the -n option gives ...


3

In FreeBSD: sockstat -4 for IPV6 sockstat -6



Only top voted, non community-wiki answers of a minimum length are eligible