Lsof: Difference between revisions

From NovaOrdis Knowledge Base
Jump to navigation Jump to search
Line 58: Line 58:
* <span id="memory_mapped_file></span>"mem" - memory-mapped file
* <span id="memory_mapped_file></span>"mem" - memory-mapped file
* "mmap"- memory-mapped device
* "mmap"- memory-mapped device
 
* "pd"- parent directory
                      pd   parent directory;
* "rtd" - root directory
                      rtd root directory;
* "tr" - kernel trace file (OpenBSD)
                      tr   kernel trace file (OpenBSD);
* "txt" - program text (code and data)
                      txt program text (code and data);
* "v86" - VP/ix mapped file
                      v86 VP/ix mapped file;
 
                  FD is followed by one of these characters, describing the mode under which the file is open:
 
                      r for read access;
                      w for write access;
                      u for read and write access;
                      space if mode unknown and no lock
                            character follows;
                      ‘-’ if mode unknown and lock
                            character follows.
 
                  The mode character is followed by one of these lock characters, describing the type of lock applied to the file:
 
                      N for a Solaris NFS lock of unknown type;
                      r for read lock on part of the file;
                      R for a read lock on the entire file;
                      w for a write lock on part of the file;
                      W for a write lock on the entire file;
                      u for a read and write lock of any length;
                      U for a lock of unknown type;
                      x for an SCO OpenServer Xenix lock on part      of the file;
                      X for an SCO OpenServer Xenix lock on the      entire file;
                      space if there is no lock.
 
                  See the LOCKS section for more information on the lock information character.

Revision as of 16:47, 3 May 2017

Internal

Overview

lsof lists information about files opened by processes. lsof provides information about:

  • regular files
  • directories
  • block special files
  • character special files
  • executing text references
  • libraries
  • streams
  • network files (Internet socket, NFS file or UNIX domain socket)

In absence of any options, lsof lists all open files by all processes.

To list open files by a specific process, use the process' PID as follows: 

lsof -p <pid>

The output is similar to: 

COMMAND   PID    USER   FD   TYPE             DEVICE SIZE/OFF    NODE NAME
java    10016 vagrant  cwd    DIR              252,2     4096 2621584 /home/test
java    10016 vagrant  rtd    DIR              252,0     4096       2 /
java    10016 vagrant  txt    REG              252,2     7734 2885001 /opt/java/x64/jre1.8.0_51/bin/java
java    10016 vagrant  mem    REG              252,0   161704 1310723 /lib64/ld-2.12.so
[...]
java    10016 vagrant    0r   CHR                1,3      0t0      26 /dev/null
java    10016 vagrant    1u   CHR              136,0      0t0       3 /dev/pts/0 (deleted)
java    10016 vagrant    2u   CHR              136,0      0t0       3 /dev/pts/0 (deleted)
java    10016 vagrant    3w   REG              252,2    48759 2753619 /home/test/gc.log.0.current
java    10016 vagrant    4r   REG              252,2 65944582 2884909 /opt/java/x64/jre1.8.0_51/lib/rt.jar
java    10016 vagrant    5u  IPv4              39331      0t0     TCP *:msgsrvr (LISTEN)
[...]

File Descriptor Information

The command provides file descriptor information by default, as the fourth field "FD". The FD column contents constitutes a single field for parsing in post-processing scripts. It can be interpreted as following: 

      FD         is the File Descriptor number of the file or:


Special entries are marked as such:

  • "cwd" - current working directory
  • "err" - FD information error (see NAME column)
  • "jld" - jail directory (FreeBSD)
  • "ltx" - shared library text (code and data)
  • "Mxx" - hex memory-mapped type number xx
  • "m86" - DOS Merge mapped file
  • "mem" - memory-mapped file
  • "mmap"- memory-mapped device
  • "pd"- parent directory
  • "rtd" - root directory
  • "tr" - kernel trace file (OpenBSD)
  • "txt" - program text (code and data)
  • "v86" - VP/ix mapped file
Retrieved from "https://kb.novaordis.com/index.php?title=Lsof&oldid=20990"