Tag Info

Hot answers tagged

19

The reason is that the operating system needs memory to manage each open file, and memory is a limited resource - especially on embedded systems. As root user you can change the maximum of the open files count per process (via ulimit -n) and per system (e.g. echo 800000 > /proc/sys/fs/file-max).


17

You can do lsof -n | grep -i "TCP\|UDP" | grep -v "ESTABLISHED\|CLOSE_WAIT" to see all of your listening ports, but dollars to donuts that ntpd is running: service ntpd status And as for "What does socket in use" mean? If I can be forgiven for smoothing over some wrinkles (and for the very basic explanation, apologies of most of this is remedial for ...


16

Programs connect to files through a number maintained by the filesystem (called an inode on traditional unix filesystems), to which the name is just a reference (and possibly not a unique reference at that). So several things to be aware of: Moving a file using mv does not change that underling number unless you move it across filesystems (which is ...


14

A hard limit can only be raised by root (any process can lower it). So it is useful for security: a non-root process cannot overstep a hard limit. But it's inconvenient in that a non-root process can't have a lower limit than its children. A soft limit can be changed by the process at any time. So it's convenient as long as processes cooperate, but no good ...


13

According to the author of lsof, it's impossible to find this out: the Linux kernel does not expose this information. Source: 2003 thread on comp.unix.admin. The number shown in /proc/$pid/fd/$fd is the socket's inode number in the virtual socket filesystem. When you create a pipe or socket pair, each end successively receives an inode number. The numbers ...


13

That's the inode number for the pipe or socket in question. A pipe is a unidirectional channel, with a write end and a read end. In your example, it looks like FD 5 and FD 6 are talking to each other, since the inode numbers are the same. (Maybe not, though. See below.) More common than seeing a program talking to itself over a pipe is a pair of separate ...


13

Running it with strace -e trace=open,close,read,write,connect,accept your-command-here would probably be sufficient. You'll need to use the -o option to put strace's output somewhere other than the console, if the process can print to stderr. If your process forks, you'll also need -f or -ff. Oh, and you might want -t as well, so you can see when the ...


12

The file descriptor, i.e. the 4 in your example, is the index into the process-specific file descriptor table, not the open file table. The file descriptor entry itself contains an index to an entry in the kernel's global open file table, as well as file descriptor flags.


11

Moving a file or directory changes the meta-data property that identifies its parent in the file tree, but it doesn't change its actual node id. On the physical disk it's still in the same place, and the filesystem still knows it as the same object. Anywhere the file or directory pointer is open, it is already connected to that object, and a change to the ...


11

Each process has its own file descriptor table. File descriptor 4 in process 1234 points inside process 1234's table. File descriptor 4 in process 5678 points inside process 5678's table. A case you must be familiar with are file descriptors 0, 1 and 2 which for each process are the standard input, standard output and standard error, pointing wherever these ...


11

Making /dev/null a named pipe is probably the easiest way. Be warned that some programs (sshd, for example) will act abnormally or fail to execute when they find out that it isn't a special file (or they may read from /dev/null, expecting it to return EOF). # Remove special file, create FIFO and read from it rm /dev/null && mkfifo -m622 /dev/null ...


11

On linux, you can find the position of the file descriptor number N of process PID in /proc/$PID/fdinfo/$N. Example: $ cat /proc/687705/fdinfo/36 pos: 26088 flags: 0100001 The same file can be opened several times with different positions using several file descriptors, so you'll have to choose the relevant one in the case there are more than one. ...


11

If you can't kill your application, you can truncate instead of deleting the log file to reclaim the space. If the file was not open in append mode (with O_APPEND), then the file will appear as big as before the next time the application writes to it (though with the leading part sparse and looking as if it contained NUL bytes), but the space will have been ...


10

Most of the time, the best command to use is lsof (“list open files”). lsof +f -- /media/usb0 where /media/usb0 is the mount point of the USB drive or other filesystem to unmount. +f -- tells lsof to treat the subsequent argument as a mount point; it usually, but not always, manages on its own, so that lsof /media/usb0 also works. This finds open files ...


10

Well on Linux you could use inotify to track changes to your files. Inotify is in-kernel and has bindings to many different languages allowing you to quickly script such functionality if the app you are working with does not support inotify yet.


10

The inodes still persist on disk, although no more hard links to the inodes exist. They will be deleted when the file descriptor is closed. Until then, the file can be modified as normal, barring operations that require a filename/hard link. debugfs and similar tools can be used to recover the contents of the inodes.


9

For sockets you can find more information about the inode in /proc/net/tcp, /proc/net/udp or /proc/net/unix. For example: ls -l /proc/<pid>/fd lrwx------ 1 root root 64 May 26 22:03 3 -> socket:[53710569] We see inode is 53710569. head -n1 < tcp ; grep -a 53710569 tcp sl local_address rem_address st tx_queue rx_queue tr tm->when ...


8

This is described on Emacs Beginner's Howto. With the line (setq auto-mode-alist (cons '("README" . text-mode) auto-mode-alist)) You tell emacs to enter "text-mode" if you open a file which is named README. with (setq auto-mode-alist (cons '("\\.html$" . html-helper-mode) auto-mode-alist)) (setq auto-mode-alist (cons '("\\.htm$" . html-helper-mode) ...


8

There is not really a more specific term. In traditional Unix, file descriptors reference entries in the file table, entries of which are referred to as files, or sometimes open files. This is in a specific context, so while obviously the term file is quite generic, in the context of the file table it specifically refers to open files. Files on disk are ...


8

You can also use netstat to look for open sockets--it's much cleaner than using lsof as the other posters have suggested. Try this command line as root netstat -lp -u -t to view all listening connections, including their associated pid's and programs. The -l parameter is what specifies listening connections, -p specifies that you want to see the PID/name ...


7

The best test to see if a server is accepting connections is to actually try connecting. Use a regular client for whatever protocol your server speaks and try a no-op command. If you want a lightweight TCP or UDP client you can drive simply from the shell, use netcat. How to program a conversation depends on the protocol; many protocols have the server ...


7

The file descriptor 1 translates to the stdout FILE structure in the Kernel's Open Files Table. This is a misunderstanding. The kernel's file table has nothing whatsoever to do with user-space file structures. In any event, the kernel has two levels of indirection. There is the internal structure that represents the file itself, which is reference ...


7

Using tail in follow mode should allow you to do what you want. tail -n +0 -f /proc/<pid>/fd/<fd> > abc.deleted I just did a quick test and it seems to work here. You did not mention whether your file was a binary file or not. My main concern is that it may not copy from the start of file but the -n +0 argument should do that even for ...


7

The operating system doesn't mess around with the open/closed state of file descriptors while an executable is running. However, once a process terminates (whether gracefully or ungracefully), if there are remaining open file descriptors, they will be destroyed along with the process image. As a general rule, though, you should always explicitly close them. ...


6

The Unix Rosetta Stone is a good resource for this kind of questions. It mentions a few alternatives for lsof (see below). Do not however that lsof is the de facto standard application for what it does. If all you want is to find the process ID(s) that have a particular file open, then you can use fuser on any POSIX-compliant system. On operating systems ...


6

Several things might be confusing here. Filedescriptors are attached to a file (in the general sense) and are specific to a given process. Filedescriptors are themselves referred to via numeric ids by their associated process, but one file descriptor can have several ids. Example: ids 1 and 2 which are called standard output and standard error usually ...


6

When you use vi/vim to edit a file you aren't actually holding ~/<filename>open you are reading the file into ~/.<filename>.swp and then holding that temp file open. If you run lsof ~/.<filename>.swp it will show you the information you are looking for. NOTE: If you have multiple people editing the same file you will need to lsof ...


5

Most systems use PAM, and have the pam_limits module set limits based on /etc/security/limits.conf. The per-user limit for open files is called nofile. You can set it for every user or for a particular user or group, and you can set a limit that the user can override (soft limit) and another that only root can override (hard limit). The documentation and the ...


5

There's no clean way to close an open file (network port or otherwise) in an application that doesn't expect it. There is a way to close the file under its nose, but the application might not react well. There's a good chance it will crash, which would defeat the purpose. You can execute a system call in a remote process with the ptrace system call. Use ...


5

I had that problem too some months ago, and I remember I had to delete some .desktop files that were inside the $HOME/.local/share/applications folder. I think you should delete any file that has notepad as part of its name, and also you should try to delete (or move somewhere else) the files wine-extension-*.



Only top voted, non community-wiki answers of a minimum length are eligible