Tag Info

Hot answers tagged

16

netstat -lnp will list the pid and process name next to each listening port. This will work under Linux, but not all others (like AIX.) Add -t if you want TCP only. # netstat -lntp Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 0.0.0.0:24800 ...


14

According to the author of lsof, it's impossible to find this out: the Linux kernel does not expose this information. Source: 2003 thread on comp.unix.admin. The number shown in /proc/$pid/fd/$fd is the socket's inode number in the virtual socket filesystem. When you create a pipe or socket pair, each end successively receives an inode number. The numbers ...


13

Running it with strace -e trace=open,close,read,write,connect,accept your-command-here would probably be sufficient. You'll need to use the -o option to put strace's output somewhere other than the console, if the process can print to stderr. If your process forks, you'll also need -f or -ff. Oh, and you might want -t as well, so you can see when the ...


12

Try: netstat -nap | grep 7080


10

You can put a -n option to lsof and then it remove the DNS resolution, which can accelerate the display


8

One way is to say lsof -i:57010 -sTCP:ESTABLISHED. This walks the kernel's open file handle table looking for processes with an established TCP connection using that port. (Network sockets are file handles on *ix type systems.) You'd use -sTCP:LISTEN on the server side to filter out only the listener socket instead. Because of the way lsof works, it can ...


8

You can use netstat -anp | grep 57010 on server C. But this will only work if there isn't any firewall in between which is mapping port 57010 to a different one.


8

Erkki Seppala actually has a tool that retrieves this information from the Linux kernel with gdb.. It's available here.


8

As recommended by IBM: use lsof -i -n and look for port XY. If you want parseable output from lsof, use the -F flag and parse the output with awk. You can get pre-compiled binaries for AIX V5. I don't know if there are pre-compiled binaries for V6; if there aren't, get the source and compile it.


7

The Unix Rosetta Stone is a good resource for this kind of questions. It mentions a few alternatives for lsof (see below). Do not however that lsof is the de facto standard application for what it does. If all you want is to find the process ID(s) that have a particular file open, then you can use fuser on any POSIX-compliant system. On operating systems ...


7

I know of fuser, see if is available on your system.


7

Try netstat, I cannot say whether its faster or slower, however. netstat -tanp | awk '$4 ~ /:8443$/ {sub(/\/.*/, "", $7); print $7}' | sort -u


6

sudo lsof -iTCP -sTCP:LISTEN sudo lsof -iTCP -sTCP:LISTEN -P sudo lsof -iTCP -sTCP:LISTEN -P -n sudo lsof -iTCP -sTCP:LISTEN -n All return the same 32 entries (... | wc -l) on my heavily used Lion MBP. -P -n prevents lsof from doing name resolution, and it doesn't block. Missing either one of these, it can be very slow. For UDP: sudo lsof -iUDP -P -n ...


6

When you use vi/vim to edit a file you aren't actually holding ~/<filename>open you are reading the file into ~/.<filename>.swp and then holding that temp file open. If you run lsof ~/.<filename>.swp it will show you the information you are looking for. NOTE: If you have multiple people editing the same file you will need to lsof ...


5

Information on the meanings of the columns can be found in the lsof(8) manpage. I will address the ones you are asking about specifically. cwd => current working directory 3r => file descriptor 3 opened for reading DIR => directory REG => regular file In order to unmount the drive, you will likely need to stop your webserver, and kill the ...


5

DTrace is able to report on vfs information in FreeBSD (as well as a raft of other probes). DTrace is enabled by default in the 10 kernel so all you need to do is load the module then run the dtrace script. Load the DTrace module kldload dtraceall Get the vfssnoop.d script from the FreeBSD forums. Run it: ./vfssnoop.d Watch the output for what is ...


4

COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME webalizer 32342 ctxmortg 5uW REG 8,17 12288 32890954 /home2/ctxmortg/tmp/webalizer/eyebestdatedotcomauph.ctxmortgagemortgagerefi.com/dns_cache.db FD - File Descriptor If you are looking for file being written, look for following flag # - The number in front of flag(s) is the file ...


4

Just for the sake of completeness: Using ss from the new Linux networking utility tool-set (iproute2): ss -tp sport = :57010 dst 192.168.1.220


4

The usage of the two are different. For lsof, to show opened files for certain path only, put -- in front of each path lsof -- /home4 lsof -- /home4 -- /home2 lsof will show all opened file containing the path. For fuser, on the other hand, show process opening the file you specified fuser -uv <filename> To show processes accessing a ...


4

The short answer is: screen. The slightly longer answer is that the -m flag to fuser tells it to list everything using the mountpoint. Depending on your setup, that probably means all of /dev, but it could also be /. Clearly not what you intended. You'll get a very long list if you do fuser -vm /dev/ttyS0, over 60 lines on my system. Take off the -m and ...


4

Well, yes. The manpage on my Debian system says “When +L is followed by a number, only files having a link count less than that number will be listed.”


4

The fourth column of lsof's output tells you that this directory is the current working directory (cwd) of the process. Most probably compton was started in this directory. Most probably you might kill the process and restart it in another directory (e.g. /). You might try forcing it to leave the directory with this hack: Attach a GDB to the process by ...


3

Try using netstat with rmsock. port=$1 addr=`netstat -Aan | grep $port | awk '{print $1}` pid=`rmsock $addr tcpcb | awk '{print $9}'` ps -ef | grep $pid For netstat, the -A shows the address of any protocol control blocks associated with the sockets, the -a option shows the state of all sockets including those of server processes, and the -n option gives ...


3

If you happen to run Solaris, an alternative to lsof, which isn't installed by default and might choke on ZFS, is pfiles. eg: pfiles /proc/*


3

In FreeBSD: sockstat -4 for IPV6 sockstat -6


3

On AIX, netstat & rmsock can be used to determine process binding: [root@aix] netstat -Ana|grep LISTEN|grep 80 f100070000280bb0 tcp4 0 0 *.37 *.* LISTEN f1000700025de3b0 tcp 0 0 *.80 *.* LISTEN f1000700002803b0 tcp4 0 0 *.111 *.* LISTEN f1000700021b33b0 ...


3

A long running lsof process usually means that DNS resolution is timing out or not working correctly which is delaying the output of it. You can disable DNS resolution by adding the -n option. Of course you might want to check out why DNS resolution is taking too long on your server as well.


3

This will select lines that begin with the c tag and print them out after removing the tag. lsof -F c somefile | sed -n 's/^c//p'


2

Another tool available on Linux is ss. From the ss man page on Fedora: NAME ss - another utility to investigate sockets SYNOPSIS ss [options] [ FILTER ] DESCRIPTION ss is used to dump socket statistics. It allows showing information similar to netstat. It can display more TCP and state informations than other tools. ...


2

For Solaris you can use pfiles and then grep by sockname: or port:. A sample (from here): pfiles `ptree | awk '{print $1}'` | egrep '^[0-9]|port:'



Only top voted, non community-wiki answers of a minimum length are eligible