Linux/Unix lsof command

Linux/Unix lsof command

[root@redhat ~]# lsof --help

lsof: illegal option character: -

lsof: -e not followed by a file system path: "lp"

lsof 4.78

latest revision: ftp://lsof.itap.purdue.edu/pub/tools/unix/lsof/

latest FAQ: ftp://lsof.itap.purdue.edu/pub/tools/unix/lsof/FAQ

latest man page: ftp://lsof.itap.purdue.edu/pub/tools/unix/lsof/lsof_man

usage: [-?abhlnNoOPRstUvVX] [+|-c c] [+|-d s] [+D D] [+|-f[gG]] [+|-e s]

[-F [f]] [-g [s]] [-i [i]] [+|-L [l]] [+m [m]] [+|-M] [-o [o]]

[-p s] [+|-r [t]] [-S [t]] [-T [t]] [-u s] [+|-w] [-x [fl]] [-Z [Z]] [--] [names]

Defaults in parentheses; comma-separated set (s) items; dash-separated ranges.

-?|-h list help          -a AND selections (OR)     -b avoid kernel blocks

-c c  cmd c, /c/[bix]    +c w  COMMAND width (9)

+d s  dir s files        -d s  select by FD set     +D D  dir D tree *SLOW?*

+|-e s  exempt s *RISKY*   -i select IPv[46] files

-l list UID numbers      -n no host names           -N select NFS files

-o list file offset      -O avoid overhead *RISKY*  -P no port names

-R list paRent PID       -s list file size          -t terse listing

-T disable TCP/TPI info  -U select Unix socket      -v list version info

-V verbose search        +|-w  Warnings (+)         -X skip TCP&UDP files

-Z Z  context [Z]

-- end option scan

+f|-f  +filesystem or -file names     +|-f[gG] flaGs

-F [f] select fields; -F? for help

+|-L [l] list (+) suppress (-) link counts < l (0 = all; default = 0)

+m [m] use|create mount supplement

+|-M   portMap registration (-)       -o o   o 0t offset digits (8)

-p s   exclude(^)|select PIDs         -S [t] t second stat timeout (15)

-T qs TCP/TPI Q,St (s) info

-g [s] exclude(^)|select and print process group IDs

-i i   select by IPv[46] address: [46][proto][@host|addr][:svc_list|port_list]

+|-r [t] repeat every t seconds (15); + until no files, - forever

-u s   exclude(^)|select login|UID set s

-x [fl] cross over +d|+D File systems or symbolic Links

names  select named files or files on named file systems

Anyone can list all files; /dev warnings disabled; kernel ID check disabled.

EXAMPLES

For a more extensive set of examples, documented more fully, see the 00QUICKSTART file of the lsof distribution.

To list all open files, use:

lsof

To list all open Internet, x.25 (HP-UX), and UNIX domain files, use:

lsof -i -U

To list all open IPv4 network files in use by the process whose PID is 1234, use:

lsof -i 4 -a -p 1234

Presuming the UNIX dialect supports IPv6, to list only open IPv6 network files, use:

lsof -i 6

To list all files using any protocol on ports 513, 514, or 515 of host wonderland.cc.purdue.edu, use:

lsof -i @wonderland.cc.purdue.edu:513-515

To list all files using any protocol on any port of mace.cc.purdue.edu (cc.purdue.edu is the default domain), use:

lsof -i @mace

To list all open files for login name ‘‘abe’’, or user ID 1234, or process 456, or process 123, or process 789, use:

lsof -p 456,123,789 -u 1234,abe

To list all open files on device /dev/hd4, use:

lsof /dev/hd4

To find the process that has /u/abe/foo open, use:

lsof /u/abe/foo

To send a SIGHUP to the processes that have /u/abe/bar open, use:

kill -HUP ‘lsof -t /u/abe/bar‘

To find any open file, including an open UNIX domain socket file, with the name /dev/log, use:

lsof /dev/log

To  find  processes  with  open files on the NFS file system named /nfs/mount/point whose server is inaccessible, and presuming your mount table supplies the device

number for /nfs/mount/point, use:

lsof -b /nfs/mount/point

To do the preceding search with warning messages suppressed, use:

lsof -bw /nfs/mount/point

To ignore the device cache file, use:

lsof -Di

To obtain PID and command name field output for each process, file descriptor, file device number, and file inode number for each file of each process, use:

lsof -FpcfDi

To list the files at descriptors 1 and 3 of every process running the lsof command for login ID ‘‘abe’’ every 10 seconds, use:

lsof -c lsof -a -d 1 -d 3 -u abe -r10

To list the current working directory of processes running a command that is exactly four characters long and has an ’o’ or ’O’ in character three, use this regular

expression form of the -c c option:

lsof -c /^..o.$/i -a -d cwd

To find an IP version 4 socket file by its associated numeric dot-form address, use:

lsof -i@128.210.15.17

To find an IP version 6 socket file (when the UNIX dialect supports IPv6) by its associated numeric colon-form address, use:

lsof -i@[0:1:2:3:4:5:6:7]

To  find  an  IP  version 6 socket file (when the UNIX dialect supports IPv6) by an associated numeric colon-form address that has a run of zeroes in it - e.g., the

loop-back address - use:

lsof -i@[::1]

[root@redhat ~]# lsof -r 2 +D /usr/bin/

COMMAND     PID USER  FD   TYPE DEVICE SIZE/OFF  NODE NAME

xfs        2331  xfs txt    REG  253,0   136200 75397 /usr/bin/xfs

rhsmcertd  2432 root txt    REG  253,0    10620 75238 /usr/bin/rhsmcertd

ssh-agent 21994 root txt    REG  253,0   107480 86481 /usr/bin/ssh-agent

=======

版权声明：本文内容由网络用户投稿，版权归原作者所有，本站不拥有其著作权，亦不承担相应法律责任。如果您发现本站中有涉嫌抄袭或描述失实的内容，请联系我们jiasou666@gmail.com 处理，核实后本网站将在24小时内删除侵权内容。