2

I wrote a script based on lsof to monitor the socket in use for each process of my particular application (one socket per process). When I specify the -i option to limit the list of opened files to sockets, some processes go missing.

Let pid_list be a constant and properly formatted comma separated list of 136 processes. Why is the result sometimes less than 136?

$ lsof -p $pid_list -a -i -nP -FpcnT | grep ^p | wc -l
135
ptxrxts5:/rxnet/hermes/envp/current
$ lsof -p $pid_list -a -i -nP -FpcnT | grep ^p | wc -l
134
ptxrxts5:/rxnet/hermes/envp/current
$ lsof -p $pid_list -a -i -nP -FpcnT | grep ^p | wc -l
136

The problem can be reproduced with as few as 1 pid.

$ clear ; lsof -p 5404  -a -i -nP -FpcnT
p5404
cprocess
nsource:port->dest:port
TST=ESTABLISHED
TQR=0
TQS=0
$ clear ; lsof -p 5404  -a -i -nP -FpcnT
### OOPS!!!
$ clear ; lsof -p 5404  -a -i -nP -FpcnT
p5404
cprocess
nsource:port->dest:port
TST=ESTABLISHED
TQR=0
TQS=0

Processes run without interruption. Each process has one socket that is either in LISTEN or ESTABLISHED state. Sockets are IPv4. This is on RHEL 5.11 with lsof 4.78.

Omitting lsof option -i will always output the correct number of processes. But that output is unusable for my purposes as I need the ip and port numbers of all processes.

Processes omitted by lsof appear to be random. They're never the same.

I suspect lsof is sensitive to something, but what?

EDIT 2016-07-26

I tried using netstat as a workaround and I encountered the same issue. The problem could be specific to my application, or some combination of what my app does and operating system constraints. Something prevents lsof/netstat from reporting properly.

  • 1
    Are they IPv4 sockets? IPv6? Show us the lsof output for the processes that are getting omitted. Are you sure that they do have an IP socket open at the time lsof looks at them? – Gilles May 9 '16 at 22:08
0

Trying using with sudo privilege. Some processes won't show if the command is not executed with sudo privilege.

  • My context does not allow using root. Besides, root shouldn't be necessary as I am inspecting processes that I own. – Philippe A. Jul 26 '16 at 18:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.