Lsof: Difference between revisions

From NovaOrdis Knowledge Base
Jump to navigation Jump to search
Line 43: Line 43:
=File Descriptor Information=
=File Descriptor Information=


The command provides file descriptor information by default, as the fourth field "FD". The FD column contents constitutes a single field for parsing in post-processing scripts. It can be interpreted as following:
The command provides file descriptor information by default, as the fourth field "FD". The FD column contents constitutes a single field for parsing in post-processing scripts.


      FD         is the File Descriptor number of the file or:
The FD column content if the file descriptor number, followed by one of these characters, describing the mode under which the file is open:


* 'r' for read access
* 'w' for write access
* 'u' for read and write access
* space if mode is unknown and no lock character follows
* ‘-’ if mode unknown and lock character follows


Special entries are marked as such:
The mode character is followed by one of these lock characters, describing the type of lock applied to the file:
 
* 'r' for read lock on part of the file
* 'R' for a read lock on the entire file
* 'w' for a write lock on part of the file
* 'W' for a write lock on the entire file
* 'u' for a read and write lock of any length
* 'U' for a lock of unknown type
* space if there is no lock
 
Special entries do not start with a file descriptor number and marked as such:


* "cwd" - current working directory
* "cwd" - current working directory

Revision as of 16:51, 3 May 2017

Internal

Overview

lsof lists information about files opened by processes. lsof provides information about:

  • regular files
  • directories
  • block special files
  • character special files
  • executing text references
  • libraries
  • streams
  • network files (Internet socket, NFS file or UNIX domain socket)

In absence of any options, lsof lists all open files by all processes.

To list open files by a specific process, use the process' PID as follows:

lsof -p <pid>

The output is similar to:

COMMAND   PID    USER   FD   TYPE             DEVICE SIZE/OFF    NODE NAME
java    10016 vagrant  cwd    DIR              252,2     4096 2621584 /home/test
java    10016 vagrant  rtd    DIR              252,0     4096       2 /
java    10016 vagrant  txt    REG              252,2     7734 2885001 /opt/java/x64/jre1.8.0_51/bin/java
java    10016 vagrant  mem    REG              252,0   161704 1310723 /lib64/ld-2.12.so
[...]
java    10016 vagrant    0r   CHR                1,3      0t0      26 /dev/null
java    10016 vagrant    1u   CHR              136,0      0t0       3 /dev/pts/0 (deleted)
java    10016 vagrant    2u   CHR              136,0      0t0       3 /dev/pts/0 (deleted)
java    10016 vagrant    3w   REG              252,2    48759 2753619 /home/test/gc.log.0.current
java    10016 vagrant    4r   REG              252,2 65944582 2884909 /opt/java/x64/jre1.8.0_51/lib/rt.jar
java    10016 vagrant    5u  IPv4              39331      0t0     TCP *:msgsrvr (LISTEN)
[...]

File Descriptor Information

The command provides file descriptor information by default, as the fourth field "FD". The FD column contents constitutes a single field for parsing in post-processing scripts.

The FD column content if the file descriptor number, followed by one of these characters, describing the mode under which the file is open:

  • 'r' for read access
  • 'w' for write access
  • 'u' for read and write access
  • space if mode is unknown and no lock character follows
  • ‘-’ if mode unknown and lock character follows

The mode character is followed by one of these lock characters, describing the type of lock applied to the file:

  • 'r' for read lock on part of the file
  • 'R' for a read lock on the entire file
  • 'w' for a write lock on part of the file
  • 'W' for a write lock on the entire file
  • 'u' for a read and write lock of any length
  • 'U' for a lock of unknown type
  • space if there is no lock

Special entries do not start with a file descriptor number and marked as such:

  • "cwd" - current working directory
  • "err" - FD information error (see NAME column)
  • "jld" - jail directory (FreeBSD)
  • "ltx" - shared library text (code and data)
  • "Mxx" - hex memory-mapped type number xx
  • "m86" - DOS Merge mapped file
  • "mem" - memory-mapped file
  • "mmap"- memory-mapped device
  • "pd"- parent directory
  • "rtd" - root directory
  • "tr" - kernel trace file (OpenBSD)
  • "txt" - program text (code and data)
  • "v86" - VP/ix mapped file