Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [lsof]

lsof is a tool to list open files of processes

-1
votes
0answers
33 views

getting error “lsof: command not found” when called from remote shell

i have a script script.sh , i use 'lsof' inside it: if ! [[ lsof -c bzip2 | grep $FILEPATH ]] the script executes successfully. However, when i call it from another machine, ssh sameUser@...
0
votes
0answers
34 views

Why can't `lsof` report some open port's information? [duplicate]

I am running this with the IP address of the same machine: $ nmap -p0-65535 192.168.1.198 Starting Nmap 7.60 ( https://nmap.org ) at 2019-03-20 10:13 EDT Nmap scan report for olive.fios-router.home (...
2
votes
1answer
35 views

Red Hat Linux - port is in listening state but could not find process ID

I have this problem for my application, port is in listening state but process ID is not showing up. Used below commands. This is cloud AWS server Red Hat Linux. $ netstat -tulpn tcp 0 ...
0
votes
2answers
71 views

kill deleted files and clean the memory cache

I want to know if kill the delete process , can help to clean the memory cache sometimes we get from lsof many deleted files so does killing them can give more available memory ? example: lsof | ...
0
votes
2answers
69 views

Does lsof always show the resolved absolute pathnames of opened files

In the output of lsof, does the NAME column always output the resolved absolute pathnames of opened files (resolved in the sense of no symlink, . or .. in the pathname)? For example, if I cd into ...
1
vote
2answers
79 views

How can I extract only the pid column and only the pathname column in the lsof output?

$ sudo lsof -u t | grep -i "\.pdf" evince 1788 t 37r REG 8,4 176328 134478 /home/t/some/path1/white space/string1 + string2 string3.pdf evince 3737 t 36r ...
0
votes
0answers
49 views

Why can I not kill a process in the same line I start it using fuser?

I have been trying to kill a process by looking at the listening port and nothing seems to be working. The code is as follows: (code to open port 8545) && fuser -k 8545/tcp I also tried with ...
2
votes
1answer
76 views

lsof versus /proc/$PID/fd versus ulimit -n

I am trying to find the reason why my long-running app sometimes busts the maximum open file descriptor limit (ulimit -n). I would like to periodically log how many file descriptors the app has open ...
0
votes
0answers
34 views

Mount error although no process is using the directory

Trying to mount a remote samba share as follows: sudo mount -t cifs -o user=pkara //11.99.4.32/logstash_config /home/pkara/Workspace/logstash_atlantis/ getting the error mount error(16): Device or ...
0
votes
1answer
91 views

is it possible to avoid open files? [closed]

when we run lsof to capture deleted files , we see the following: ( example ) lsof +L1 java 193699 yarn 1760r REG 8,16 719 0 93696130 /grid/sdb/hadoop/hdfs/data/current/PLP-...
0
votes
0answers
38 views

Service stuck and consuming disk space

What is the best practice to avoid this case Example, filebeat 5098 5128 root 3r REG 253,1 31035908096 657022 /var/log/aaa/aaa.access.log.1 (deleted) There is a ...
1
vote
1answer
101 views

How shall I understand the output of `NAME` field of `lsof`?

$ sudo lsof +E -a -U -p 1480 lsof: WARNING: can't stat() fuse.gvfsd-fuse file system /run/user/1000/gvfs Output information may be incomplete. lsof: WARNING: can't stat() fuse.gvfsd-fuse file ...
0
votes
3answers
53 views

Get a certain column of an output with content aligned right and some columns not always filled

This is a problem I often encounter, this time with the output of lsof, but I am searching for a general solution for such problems: selecting a column. Here I try to get the TYPE column of the ...
0
votes
0answers
82 views

Cannot kill my lsof processes even as root

My lsof is hung so bad that I can't even kill -9 it. Initially, it was owned by another process, foo. I tried killing foo, hoping that lsof would also go way. But while I was able to kill -9 foo, now ...
1
vote
0answers
398 views

lsof shows protocol: TCP

I ran sudo lsof -p $(pidof foo) and I got a lot of these. Does anyone know what these represent? I know they come from the process but there are no ports / IP addresses. COMMAND PID USER FD ...
1
vote
1answer
81 views

lsof doesn't show up my djvu files

I am trying to print the djvu file names that are currently running on either okular or atril, but when I do lsof | grep ".djvu$" then I am getting no output in the terminal, where the same command ...
0
votes
4answers
79 views

command shuts down too quickly for me to lsof it [duplicate]

Might be idiotic, but I'm running a command that completes very fast, so I don't have enough time to lsof it from another window and see which files is it holding open. Is there some obvious way to ...
1
vote
1answer
49 views

What does lsof -ad3-999 -c rsync do?

I was trying to see the progress of a already running rsync and cp task and found this answer that allowed me to see what was currently happening When i went to the man page for lsof and see that -c ...
0
votes
1answer
59 views

How to list all the processes which have accessed a particular file? [duplicate]

strace can monitor only one single processes not all, lsof is not a good way too, it's not a real time tool, maybe I need a real time version of lsof? How to list all the processes which have accessed ...
0
votes
1answer
188 views

Is it possible to list all files that are opened by a process [duplicate]

I know that lsof can list all files which are being opened by running processes. If there is a process, which will open a file and then will be terminated, I don't think I can catch the file that is ...
1
vote
1answer
76 views

What does “localhost:tram” message means?

I have deployed an application in Glassfish. I see "localhost:tram" in the list of open files : java 30842 user 1589u IPv6 555599352 0t0 TCP localhost:57171->localhost:tram (CLOSE_WAIT) java 30842 ...
1
vote
0answers
214 views

netstat show a listen port but pid don't exist and can't find it with lsof

I am running macOS(0.13.6) and while trying to test tinc, I get a warning that port 0.0.0.0:655 is already in use. This is the output I get from netstat: $ sudo netstat -anv -p udp Active Internet ...
2
votes
1answer
41 views

How to link a tunX interface to a specific OpenVPN instance?

I known that I can give a specific name to the TUN interface using --dev option, but I didn't and I have now on a router machine something like a hundred client configs. with less clients I was able ...
2
votes
1answer
146 views

Find processes which have a file open without lsof or fuser

I'm working on a Linux (Scientific Linux CERN SLC release 6.9 (Carbon)) machine on which I am unable to install programs and on which the lsof or fuser commands are not available. I'm trying to ...
0
votes
0answers
204 views

disk in use in-spite we perform umount and lsof is empty

we want to perform fsck -f on /dev/sdc but without success umount -l /var/hadoop/zookeper lsof /var/hadoop/zookeeper/ fsck -f /dev/sdc fsck from util-linux 2.23.2 e2fsck 1.42.9 ...
2
votes
1answer
244 views

What is the difference between lsof vs lsof -i

One of my processes running on Debian server started throwing a socket: too many open files error. I then started debugging the error. I came through the following scenario. When I ran lsof | grep ...
1
vote
2answers
266 views

Linux memory mapped files

Output of lsof on my RHEL7 shows that one file with file descriptor mem is used by 40 processes. Does it mean that this file is mapped in memory 40 times or what? Could someone please explain what ...
0
votes
1answer
189 views

What does the asterisk (*) mean in lsof output?

I set my TCP server to localhost 127.0.0.1, but instead of seeing 127.0.0.1 in the host portion of the lsof output, I see an asterisk. After running lsof -i... my_process 66666 root 5u IPv4 0xffff......
1
vote
2answers
131 views

Trying to pass some output of lsof -Pi to geoiplookup

Looking for a way to pass the second column of output to geoiplookup, ideally on the same line, but not necessarily. This is the best I can muster. It's usable, but the geoiplookup results are ...
1
vote
0answers
50 views

Can't find the reason why root directory usage is so large [duplicate]

Everyone. I have a very difficult thing to do. I have a Linux server, and the root directory has 16GB of space. df -h, shows the / directory has been used for 15GB, but du -sh shows that only 5.9GB ...
0
votes
1answer
4k views

“Device or Resource Busy”

I am trying to delete a directory using rm -rf dirName But I receive a bunch of errors like: rm: cannot remove 'deleteMe/icarus/.nfs0000001bcf11514a0000cd45': Device or resource busy When I try ...
4
votes
1answer
633 views

FD column of `lsof` shows DEL in some cases, instead of an FD number

What does this mean? How does lsof find such FDs? I.e. compared to normal FDs, which can be found easily like ls -l /proc/$PID/fd/$FD. $ lsof -p $(pgrep pulseaudio) | head -n1 COMMAND PID ...
0
votes
1answer
61 views

Open connections with unresolvable domain

Output of sudo watch lsof -i and sudo watch netstat -tp show ESTABLISHED connections with unresolvable domain (e.g., host, dig woldn't resolve, trying to access domain directly via URL from firefox ...
0
votes
1answer
827 views

How to use lsof to list all files open by the parent process AND it's children?

lsof -p PID works fine to list all files open by a single process, but I need to list all currently open files by a specific master process AND it's children processes. What is the best way to do ...
2
votes
0answers
416 views

File shows up in ls but cannot rm or mv, seems to be held by some unknown process

I do a lot of work on an SGE cluster running CentOS 7, and have recently had issues with jobs dying randomly, but seemingly with some processes still running that prevent me from cleaning up to start ...
2
votes
2answers
179 views

find pid of open tcp port, as a regular user

From local host I'm ssh tunneling some remote host:port to my local host:port, so anybody on a remote host can use their "local" port to access my port via that tunnel. I'm using some regular (non-...
1
vote
2answers
559 views

How to test if processes are using files in directory

I'm trying to use lsof in an IF statement to tar a directory ONLY if other programs are NOT using files within the directory. I can get this info at a shell prompt with lsof +d /mydir/ If it doesn'...
0
votes
1answer
393 views

LSOF output is showing duplicates

I am trying to troubleshoot an issue and whenever I do lsof, I see that a process is eating up this one file. This file is mentioned 12x in the output, it has everything same (path, size, PID, and ...
15
votes
4answers
494 views

Unable to remount / back to read-only after package upgrade

I am using Debian Stretch. My root partition is mounted read-only. Only when I install or upgrade packages, is / remounted to read-write (by using apt hook), and then remounted back to ro. Sometimes ...
1
vote
1answer
74 views

Is there any option/command to differentiate files based on copy status of the file in the directory?

I have the below code which checks if the file in the directory is in copy/load status from another application in a directory. Code: for file in PATH/* do lsofresult=`lsof | grep $file | wc -l`...
3
votes
0answers
911 views

lsof: list only files of a particular type

The lsof man page is a bugger to read. I've tried, but wonder if I've missed something. Is there a way without using pipes to have lsof list only files of a given TYPE? In particular, I'm interested ...
5
votes
2answers
3k views

List current inotify watches (pathname, PID)

How do I get a list of: Pathnames currently being watched by inotify, and PID of the process watching I ask because I have found that syncthing's inotify watches were preventing my disk from being ...
1
vote
2answers
310 views

List processes accessing device after `umount --lazy`

I want to remove my external HDD as safely as possible. I want to use umount --lazy: Lazy unmount. Detach the filesystem from the file hierarchy now, and clean up all references to this ...
0
votes
1answer
471 views

Apache: High disk read load, no requests

On an Ubuntu VM iotop shows me that some "apache2 -k start" processes are producing a total disk read load of constantly between 4 M/s and 7 M/s even while no requests are being logged. lsof shows me ...
1
vote
1answer
935 views

Count the number of file descriptors opened by a process with lsof

I need to check the number of file descriptors which are open by a Java process. The output of lsof is almost 40000 lines long. Here's just the beginning: COMMAND PID USER FD TYPE ...
0
votes
1answer
2k views

What does the DEVICE field stand for in lsof? [closed]

Here is an abridged output of lsof -i tcp:XXXXXX: COMMAND PID USER FD TYPE DEVICE python3 9336 root 3u IPv4 3545328 python3 9336 root 5u IPv4 3545374
-1
votes
1answer
95 views

Inconsistent lsof output [closed]

I am running few java processes on a machine and I wanted an exact count of number of open files and what kind those files. First of all, running sudo lsof takes a long time. [user@host]:~$ time ...
1
vote
1answer
273 views

memory fault in lsof [closed]

I am trying to check a port with lsof: lsof -i :443 but it gives me an error message that says: /usr/local/bin/lsof[30]: 6226000 Memory fault(coredump) Why is this happening, and how can I solve ...
6
votes
1answer
206 views

How to find what programs are reading my file?

I have a configuration file and want to learn what executables are using it (if any). I want to catch who is the reader of this file. If I watch with some interval, I miss it, because the read ...
22
votes
3answers
7k views

Are files opened by processes loaded into RAM?

Commands, for instance sed, are programs and programs are codified logic inside a file and these files are somewhere on the hard disk. However when commands are being run, a copy of their files from ...