0

I am trying to troubleshoot an issue and whenever I do lsof, I see that a process is eating up this one file. This file is mentioned 12x in the output, it has everything same (path, size, PID, and node) but the only difference is FD.

Does anyone know if this is normal? why does output showing this file open in multiple lines with different FD but everything else same?

Here output:

COMMAND       PID  USER   FD  TYPE    DEVICE    SIZE/OFF      NODE   NAME Path

php         14234  root  12r VREG      255,1   234580322    423532   /[path_to_file]/kMiles (line 21)
php         14234  root  17r VREG      255,1   234580322    423532   /[path_to_file]/kMiles (line 29)
php         14234  root  21r VREG      255,1   234580322    423532   /[path_to_file]/kMiles (line 36)
php         14234  root  27r VREG      255,1   234580322    423532   /[path_to_file]/kMiles (line 43)
  • Could it simply be that this process has the file open multiple times? If possible, edit your question to include the relevant part of lsof's output. – dhag Oct 13 '17 at 16:54
  • I put an example of the output. I only put 4 of them, but it is mentioned total of 12 times in the lsof output. – user3103798 Oct 13 '17 at 17:05
1

From the output you posted, it looks like the php process with PID 14234 is running as root, and indeed has the kMiles file open several times, as the differing FDs indicate.

If this has unexpected elements (the file name, PHP running as root), this could indicate a compromised server, but the output from lsof itself makes sense.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.