Hot answers tagged open-files
17
The reason is that the operating system needs memory to manage each open file, and memory is a limited resource - especially on embedded systems.
As root user you can change the maximum of the open files count per process (via ulimit -n) and per system (e.g. echo 800000 > /proc/sys/fs/file-max).
15
Programs connect to files through a number maintained by the filesystem (called an inode on traditional unix filesystems), to which the name is just a reference (and possibly not a unique reference at that).
So several things to be aware of:
Moving a file using mv does not change that underling number unless you move it across filesystems (which is ...
15
You can do
lsof -n | grep -i "TCP\|UDP" | grep -v "ESTABLISHED\|CLOSE_WAIT"
to see all of your listening ports, but dollars to donuts that ntpd is running:
service ntpd status
And as for "What does socket in use" mean? If I can be forgiven for smoothing over some wrinkles (and for the very basic explanation, apologies of most of this is remedial for ...
11
According to the author of lsof, it's impossible to find this out: the Linux kernel does not expose this information. Source: 2003 thread on comp.unix.admin.
The number shown in /proc/$pid/fd/$fd is the socket's inode number in the virtual socket filesystem. When you create a pipe or socket pair, each end successively receives an inode number. The numbers ...
11
The file descriptor, i.e. the 4 in your example, is the index into the process-specific file descriptor table, not the open file table. The file descriptor entry itself contains an index to an entry in the kernel's global open file table, as well as file descriptor flags.
11
Making /dev/null a named pipe is probably the easiest way. Be warned that some programs (sshd, for example) will act abnormally or fail to execute when they find out that it isn't a special file (or they may read from /dev/null, expecting it to return EOF).
# Remove special file, create FIFO and read from it
rm /dev/null && mkfifo -m622 /dev/null ...
11
Running it with
strace -e trace=open,close,read,write,connect,accept your-command-here
would probably be sufficient.
You'll need to use the -o option to put strace's output somewhere other than the console, if the process can print to stderr. If your process forks, you'll also need -f or -ff.
Oh, and you might want -t as well, so you can see when the ...
10
That's the inode number for the pipe or socket in question.
A pipe is a unidirectional channel, with a write end and a read end. In your example, it looks like FD 5 and FD 6 are talking to each other, since the inode numbers are the same. (Maybe not, though. See below.)
More common than seeing a program talking to itself over a pipe is a pair of separate ...
10
Well on Linux you could use inotify to track changes to your files. Inotify is in-kernel and has bindings to many different languages allowing you to quickly script such functionality if the app you are working with does not support inotify yet.
10
Each process has its own file descriptor table. File descriptor 4 in process 1234 points inside process 1234's table. File descriptor 4 in process 5678 points inside process 5678's table. A case you must be familiar with are file descriptors 0, 1 and 2 which for each process are the standard input, standard output and standard error, pointing wherever these ...
9
Most of the time, the best command to use is lsof (“list open files”).
lsof +f -- /media/usb0
where /media/usb0 is the mount point of the USB drive or other filesystem to unmount. +f -- tells lsof to treat the subsequent argument as a mount point; it usually, but not always, manages on its own, so that lsof /media/usb0 also works. This finds open files ...
9
Moving a file or directory changes the meta-data property that identifies its parent in the file tree, but it doesn't change its actual node id. On the physical disk it's still in the same place, and the filesystem still knows it as the same object. Anywhere the file or directory pointer is open, it is already connected to that object, and a change to the ...
9
The inodes still persist on disk, although no more hard links to the inodes exist. They will be deleted when the file descriptor is closed. Until then, the file can be modified as normal, barring operations that require a filename/hard link.
debugfs and similar tools can be used to recover the contents of the inodes.
9
On linux, you can find the position of the file descriptor number N of process PID in /proc/$PID/fdinfo/$N. Example:
$ cat /proc/687705/fdinfo/36
pos: 26088
flags: 0100001
The same file can be opened several times with different positions using several file descriptors, so you'll have to choose the relevant one in the case there are more than one. ...
8
This is described on Emacs Beginner's Howto.
With the line
(setq auto-mode-alist (cons '("README" . text-mode) auto-mode-alist))
You tell emacs to enter "text-mode" if you open a file which is named README.
with
(setq auto-mode-alist (cons '("\\.html$" . html-helper-mode) auto-mode-alist))
(setq auto-mode-alist (cons '("\\.htm$" . html-helper-mode) ...
8
There is not really a more specific term. In traditional Unix, file descriptors reference entries in the file table, entries of which are referred to as files, or sometimes open files. This is in a specific context, so while obviously the term file is quite generic, in the context of the file table it specifically refers to open files.
Files on disk are ...
8
A hard limit can only be raised by root (any process can lower it). So it is useful for security: a non-root process cannot overstep a hard limit. But it's inconvenient in that a non-root process can't have a lower limit than its children.
A soft limit can be changed by the process at any time. So it's convenient as long as processes cooperate, but no good ...
8
If you can't kill your application, you can truncate instead of deleting the log file to reclaim the space. If the file was not open in append mode (with O_APPEND), then the file will appear as big as before the next time the application writes to it (though with the leading part sparse and looking as if it contained NUL bytes), but the space will have been ...
7
You can also use netstat to look for open sockets--it's much cleaner than using lsof as the other posters have suggested. Try this command line as root
netstat -lp -u -t
to view all listening connections, including their associated pid's and programs. The -l parameter is what specifies listening connections, -p specifies that you want to see the PID/name ...
7
The best test to see if a server is accepting connections is to actually try connecting. Use a regular client for whatever protocol your server speaks and try a no-op command.
If you want a lightweight TCP or UDP client you can drive simply from the shell, use netcat. How to program a conversation depends on the protocol; many protocols have the server ...
7
Using tail in follow mode should allow you to do what you want.
tail -n +0 -f /proc/<pid>/fd/<fd> > abc.deleted
I just did a quick test and it seems to work here. You did not mention whether your file was a binary file or not. My main concern is that it may not copy from the start of file but the -n +0 argument should do that even for ...
6
For sockets, you can find the inode number in /proc/net/tcp and /proc/net/udp. For example:
lrwx------ 1 root root 64 May 26 22:03 3 -> socket:[53710569]
sl local_address rem_address st tx_queue rx_queue tr tm->when retrnsmt uid timeout inode
155: 0100007F:001B 00000000:0000 0A 00000000:00000000 00:00000000 00000000 0 ...
6
Several things might be confusing here.
Filedescriptors are attached to a file (in the general sense) and are specific to a given process. Filedescriptors are themselves referred to via numeric ids by their associated process, but one file descriptor can have several ids. Example: ids 1 and 2 which are called standard output and standard error usually ...
5
The file descriptor 1 translates to the stdout FILE structure in the Kernel's Open Files Table.
This is a misunderstanding. The kernel's file table has nothing whatsoever to do with user-space file structures.
In any event, the kernel has two levels of indirection. There is the internal structure that represents the file itself, which is reference ...
5
I had that problem too some months ago, and I remember I had to delete some .desktop files that were inside the $HOME/.local/share/applications folder.
I think you should delete any file that has notepad as part of its name, and also you should try to delete (or move somewhere else) the files wine-extension-*.
5
Most systems use PAM, and have the pam_limits module set limits based on /etc/security/limits.conf. The per-user limit for open files is called nofile. You can set it for every user or for a particular user or group, and you can set a limit that the user can override (soft limit) and another that only root can override (hard limit). The documentation and the ...
5
In general, Unix commands treat files the same, whether they are open and being written to or not. So if a cron job is using cp to copy a directory, what gets copied depends solely on what is in the directory at the time the cp command examines the directory. If a file is only partially written at the time cp visits it, a partially written copy will be ...
5
When you use vi/vim to edit a file you aren't actually holding ~/<filename>open you are reading the file into ~/.<filename>.swp and then holding that temp file open.
If you run lsof ~/.<filename>.swp it will show you the information you are looking for.
NOTE: If you have multiple people editing the same file you will need to lsof ...
4
There's no clean way to close an open file (network port or otherwise) in an application that doesn't expect it.
There is a way to close the file under its nose, but the application might not react well. There's a good chance it will crash, which would defeat the purpose. You can execute a system call in a remote process with the ptrace system call. Use ...
4
The Unix Rosetta Stone is a good resource for this kind of questions. It mentions a few alternatives for lsof (see below). Do not however that lsof is the de facto standard application for what it does.
If all you want is to find the process ID(s) that have a particular file open, then you can use fuser on any POSIX-compliant system.
On operating systems ...
Only top voted, non community-wiki answers of a minimum length are eligible
