Tag Info

Hot answers tagged

29

netstat -lnp will list the pid and process name next to each listening port. This will work under Linux, but not all others (like AIX.) Add -t if you want TCP only. # netstat -lntp Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 0.0.0.0:24800 ...


20

Running it with strace -e trace=open,close,read,write,connect,accept your-command-here would probably be sufficient. You'll need to use the -o option to put strace's output somewhere other than the console, if the process can print to stderr. If your process forks, you'll also need -f or -ff. Oh, and you might want -t as well, so you can see when the ...


17

Since kernel 3.3, it is possible using ss — see Stéphane Chazelas's answer. In older versions, according to the author of lsof, it was impossible to find this out: the Linux kernel does not expose this information. Source: 2003 thread on comp.unix.admin. The number shown in /proc/$pid/fd/$fd is the socket's inode number in the virtual socket filesystem. ...


12

Try: netstat -nap | grep 7080


12

sudo lsof -iTCP -sTCP:LISTEN sudo lsof -iTCP -sTCP:LISTEN -P sudo lsof -iTCP -sTCP:LISTEN -P -n sudo lsof -iTCP -sTCP:LISTEN -n All return the same 32 entries (... | wc -l) on my heavily used Lion MBP. -P -n prevents lsof from doing name resolution, and it doesn't block. Missing either one of these, it can be very slow. For UDP: sudo lsof -iUDP -P -n ...


10

COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME webalizer 32342 ctxmortg 5uW REG 8,17 12288 32890954 /home2/ctxmortg/tmp/webalizer/eyebestdatedotcomauph.ctxmortgagemortgagerefi.com/dns_cache.db FD - File Descriptor If you are looking for file being written, look for following flag # - The number in front of flag(s) is the file ...


10

You can put a -n option to lsof and then it remove the DNS resolution, which can accelerate the display


10

I know of fuser, see if is available on your system.


9

Erkki Seppala actually has a tool that retrieves this information from the Linux kernel with gdb.. It's available here.


9

Note: I now maintain a lsof wrapper that combines both approaches described here and also adds information for peers of loopback TCP connections at https://github.com/stephane-chazelas/misc-scripts/blob/master/lsofc Linux-3.3 and above. On Linux, since kernel version 3.3 (and provided the UNIX_DIAG feature is built in the kernel), the peer of a given ...


9

As recommended by IBM: use lsof -i -n and look for port XY. If you want parseable output from lsof, use the -F flag and parse the output with awk. You can get pre-compiled binaries for AIX V5. I don't know if there are pre-compiled binaries for V6; if there aren't, get the source and compile it.


9

The Unix Rosetta Stone is a good resource for this kind of questions. It mentions a few alternatives for lsof (see below). Do not however that lsof is the de facto standard application for what it does. If all you want is to find the process ID(s) that have a particular file open, then you can use fuser on any POSIX-compliant system. On operating systems ...


9

From the lsof man page Lsof returns a one (1) if any error was detected, including the failure to locate command names, file names, Internet addresses or files, login names, NFS files, PIDs, PGIDs, or UIDs it was asked to list. If the -V option is specified, lsof will indicate the search items it failed to list. ...


8

One way is to say lsof -i:57010 -sTCP:ESTABLISHED. This walks the kernel's open file handle table looking for processes with an established TCP connection using that port. (Network sockets are file handles on *ix type systems.) You'd use -sTCP:LISTEN on the server side to filter out only the listener socket instead. Because of the way lsof works, it can ...


8

You can use netstat -anp | grep 57010 on server C. But this will only work if there isn't any firewall in between which is mapping port 57010 to a different one.


7

Try netstat, I cannot say whether its faster or slower, however. netstat -tanp | awk '$4 ~ /:8443$/ {sub(/\/.*/, "", $7); print $7}' | sort -u


7

When you use vi/vim to edit a file you aren't actually holding ~/<filename>open you are reading the file into ~/.<filename>.swp and then holding that temp file open. If you run lsof ~/.<filename>.swp it will show you the information you are looking for. NOTE: If you have multiple people editing the same file you will need to lsof ...


6

Information on the meanings of the columns can be found in the lsof(8) manpage. I will address the ones you are asking about specifically. cwd => current working directory 3r => file descriptor 3 opened for reading DIR => directory REG => regular file In order to unmount the drive, you will likely need to stop your webserver, and kill the ...


6

I believe since you do not know the file name/process id, you could specify user name option as below. lsof -r 2 -u username The "-r 2" option puts lsof in repeat mode, with updates every 2 seconds. (Ctrl -c quits) The "-u' option can be used to keep an eye on a users activity. If you know the directory name under which the application is being run ...


5

On AIX, netstat & rmsock can be used to determine process binding: [root@aix] netstat -Ana|grep LISTEN|grep 80 f100070000280bb0 tcp4 0 0 *.37 *.* LISTEN f1000700025de3b0 tcp 0 0 *.80 *.* LISTEN f1000700002803b0 tcp4 0 0 *.111 *.* LISTEN f1000700021b33b0 ...


5

Since kernel 3.3 You can now get this information with ss: # ss -xp Now you can see in the Peer column an ID (inode number) which corresponds to another ID in the Local column. Matching IDs are the two ends of a socket. Note: The UNIX_DIAG option must be enabled in your kernel. Before kernel 3.3 Linux didn't expose this information to userland. ...


5

If you happen to run Solaris, an alternative to lsof, which isn't installed by default and might choke on ZFS, is pfiles. eg: pfiles /proc/*


5

The usage of the two are different. For lsof, to show opened files for certain path only, put -- in front of each path lsof -- /home4 lsof -- /home4 -- /home2 lsof will show all opened file containing the path. For fuser, on the other hand, show process opening the file you specified fuser -uv <filename> To show processes accessing a ...


5

DTrace is able to report on vfs information in FreeBSD (as well as a raft of other probes). DTrace is enabled by default in the 10 kernel so all you need to do is load the module then run the dtrace script. Load the DTrace module kldload dtraceall Get the vfssnoop.d script from the FreeBSD forums. Run it: ./vfssnoop.d Watch the output for what is ...


4

Just for the sake of completeness: Using ss from the new Linux networking utility tool-set (iproute2): ss -tp sport = :57010 dst 192.168.1.220


4

This solution, though working, is of limited interest since if you have a recent-enough systemtap, chances are you'll have a recent-enough kernel where you can use ss based approaches, and if you're on an older kernel, that other solution, though more hacky is more likely to work and doesn't require addition software. Still useful as a demonstration ...


4

Try using netstat with rmsock. port=$1 addr=`netstat -Aan | grep $port | awk '{print $1}` pid=`rmsock $addr tcpcb | awk '{print $9}'` ps -ef | grep $pid For netstat, the -A shows the address of any protocol control blocks associated with the sockets, the -a option shows the state of all sockets including those of server processes, and the -n option gives ...


4

The short answer is: screen. The slightly longer answer is that the -m flag to fuser tells it to list everything using the mountpoint. Depending on your setup, that probably means all of /dev, but it could also be /. Clearly not what you intended. You'll get a very long list if you do fuser -vm /dev/ttyS0, over 60 lines on my system. Take off the -m and ...


4

Well, yes. The manpage on my Debian system says “When +L is followed by a number, only files having a link count less than that number will be listed.”


4

The fourth column of lsof's output tells you that this directory is the current working directory (cwd) of the process. Most probably compton was started in this directory. Most probably you might kill the process and restart it in another directory (e.g. /). You might try forcing it to leave the directory with this hack: Attach a GDB to the process by ...



Only top voted, non community-wiki answers of a minimum length are eligible