Given a pid, I can get all the files open for writing something like:

lsof -p 28827 | awk '$4 ~ "[wW]"{print $(NF-1), $NF}'

One of those ends up being a pipe:

28827 232611 pipe

I want to look-up all the files open by that pipe. If I just do:

lsof | grep 232611

That gives me a bunch of processes, one of which is a tee:

<app>     28827       <me>       1w     FIFO                0,8       0t0  232611 pipe
<app>     28827 28836 <me>       1w     FIFO                0,8       0t0  232611 pipe
<app>     28827 28901 <me>       1w     FIFO                0,8       0t0  232611 pipe
tee       28828       <me>       0r     FIFO                0,8       0t0  232611 pipe

How can I programmatically find the PID for the tee (or generally, any process open with r access)? I can't simply check $4 ~ "r" since for most of the rows, $4 isn't even the FD column.

  • What OS are you using? Is this Linux or another *nix? – terdon May 28 '15 at 16:11
  • Linux, RHEL 7.1. – Barry May 28 '15 at 16:12

It should be enough to just grep for digits followed by one or more rs:

lsof | grep -P '\b\d+r+\b'

Or, if you don't have GNU grep:

lsof | grep -E '\b[0-9]+r+\b' 

The \bs mark word boundaries and ensure that only entire fields are matched. Alternatively, if your grep supports it, you can use the -w flag:

lsof | grep -wE '[0-9]+r+' 

So, using that, you can get the relevant PIDs with

lsof | grep -wE '[0-9]+r+' a | awk '{print $2}'

@derobert pointed out in the comments below that, had I taken the time to actually read through the 2562 lines of man lsof, I would have found that it offers an -F option that lets you choose the fields printed. To get the file's access type, use a:

lsof -p 28827 -F a 
  • 1
    Might also want to look at "OUTPUT FOR OTHER PROGRAMS" in the lsof manpage. – derobert May 28 '15 at 16:25
  • @derobert Can you elaborate? I've read that section and I cannot come up with a sequence of arguments that does the right thing for me. – Barry May 28 '15 at 16:49
  • @derobert I admit that the lsof manpage is one of the scariest documents I've ever tried to read. Right up there with Ulysses and man rsync. I did find something that's probably relevant with your hint though, thanks. – terdon May 28 '15 at 16:50
  • @terdon lsof -p 28827 -F a just gives me a bunch of as, aus, aws, and ars. – Barry May 28 '15 at 16:59
  • @Barry yeah, it prints everything on its own line, very annoying. You'll have the first line with pNNN, that's the PID. The rest will be a[rwu] and are the access types. You switch to the next entry when you have another line starting with p. – terdon May 28 '15 at 17:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.