Shulou(Shulou.com)06/01 Report--

This article mainly shows you "what is the use of the lsof command in Linux", the content is easy to understand, clear, hope to help you solve your doubts, the following let the editor lead you to study and learn "what is the use of lsof command in Linux" this article.

Linux common commands lsof commands are used to view the files opened by your process, the process of opening files, and the ports opened by the process (TCP, UDP). Retrieve / recover deleted files. Is a very convenient system monitoring tool, because the lsof command requires access to core memory and various files, so it needs to be executed by root users.

Lsof displays a list of all files currently open on the Linux system lsof-p pid

Add that in the linux environment, everything exists in the form of files, through which you can access not only regular data, but also network connections and hardware. Therefore, such as Transmission Control Protocol (TCP) and user Datagram Protocol (UDP) sockets, the system allocates a file descriptor to the application in the background, regardless of the nature of the file, the file descriptor provides a general interface for the interaction between the application and the underlying operating system. Because the descriptor list of the application's open files provides a lot of information about the application itself, being able to view this list through the lsof tool will be helpful for system monitoring and debugging.

Syntax lsof (option) option-a: list the processes that open the file;-c: list the files opened by the specified process;-g: list the process details of the GID number;-d: list the processes occupying the file number; + d: list the files opened in the directory; + D: recursively list the files opened in the directory;-n: list the files using NFS -I: list the eligible processes (protocol,: Port, @ ip)-p: list the files opened by the specified process number;-u: list the process details of the UID number;-h: display help information -v: display version information instance lsof command PID USER FD type DEVICE SIZE NODE NAME init 1 root cwd DIR 8 root rtd DIR 2 4096 2 / init 1 root rtd DIR 8 init 2 4096 2 / init 1 root txt REG 8 init 2 43496 6121706 / sbin/init init 1 root mem REG 8,2 143600 7823908 / lib64/ld-2.5.so init 1 root mem REG 8,2 1722304 7823915 / lib64/libc-2.5.so init 1 root mem REG 8,2 23360 7823919 / lib64/libdl-2.5.so init 1 root mem REG 8,2 95464 7824116 / lib64/libselinux.so.1 init 1 root mem REG 8,2 247496 7823947 / lib64/libsepol.so.1 init 1 root 10u FIFO 0,17 1233 / dev/initctl migration 2 root cwd DIR 8,2 4096 2 / migration 2 root rtd DIR 8,2 4096 2/ migration 2 root txt unknown / proc/2/exe ksoftirqd 3 root cwd DIR 8,2 4096 2/ ksoftirqd 3 root rtd DIR 8,2 4096 2/ ksoftirqd 3 root txt unknown / proc/3/exe migration 4 root cwd DIR 8,2 4096 2 / migration 4 root rtd DIR 8,2 4096 2 / migration 4 root txt unknown / proc/4/exe ksoftirqd 5 root cwd DIR 8,2 4096 2 / ksoftirqd 5 root rtd DIR 8,2 4096 2 / ksoftirqd 5 root txt unknown / proc/5/exe events/0 6 root cwd DIR 8,2 4096 2 / events/0 6 root rtd DIR 8 events/0 2 4096 2 / proc/6/exe events/1 6 root txt unknown / proc/6/exe events/1 7 root cwd DIR 8 4096 2 / lsof output the significance of each column of information:

COMMAND: the name of the process

PID: process identifier

PPID: parent process identifier (the-R parameter needs to be specified)

USER: process owner

PGID: the group to which the process belongs

FD: a file descriptor that the application recognizes by the file descriptor.

List of file descriptors:

Cwd: indicates current work dirctory, that is, the current working directory of the application, which is the directory where the application starts, unless it makes changes to the directory itself

Txt: this type of file is program code, such as the application binary itself or a shared library, such as the / sbin/init program shown in the list above

Lnn:library references (AIX)

Er:FD information error (see NAME column)

Jld:jail directory (FreeBSD)

Ltx:shared library text (code and data)

Mxx: hex memory-mapped type number xx.

M86:DOS Merge mapped file

Mem:memory-mapped file

Mmap:memory-mapped device

Pd:parent directory

Rtd:root directory

Tr:kernel trace file (OpenBSD)

V86 VP/ix mapped file

0: represents standard output

1: indicates standard input

2: indicates standard error

It is generally followed by file status mode after standard output, standard error, and standard input:

U: indicates that the file is open and in read / write mode.

R: indicates that the file is open and in read-only mode.

W: indicates that the file is open and in write mode.

Space: indicates that the status mode of the file is unknow and is not locked.

-: indicates that the state mode of the file is unknow and is locked.

At the same time, the file status mode is followed by the relevant locks:

N:for a Solaris NFS lock of unknown type

R:for read lock on part of the file

R:for a read lock on the entire file

W:for a write lock on part of the file; (partial write lock of the file)

W:for a write lock on the entire file; (write lock for the entire file)

U:for a read and write lock of any length

U:for a lock of unknown type

X:for an SCO OpenServer Xenix lock on part of the file

X:for an SCO OpenServer Xenix lock on the entire file

Space:if there is no lock.

File type:

DIR: represents a directory.

CHR: indicates the character type.

BLK: block device type.

UNIX: UNIX domain socket.

FIFO: first-in, first-out (FIFO) queue.

IPv4: Internet Protocol (IP) socket.

DEVICE: specifies the name of the disk

SIZE: the size of the file

NODE: Inode (identification of files on disk)

NAME: the exact name of the open file

REG: general fil

Lists the files opened by the specified process number:

Lsof-p $pid get the process ID= > pid corresponding to the port

Lsof-iVaR 9981-P-t-sTCP:LISTEN lists the processes that open the file:

Lsof $filename above is all the content of this article entitled "what is the use of lsof commands in Linux?" Thank you for reading! I believe we all have a certain understanding, hope to share the content to help you, if you want to learn more knowledge, welcome to follow the industry information channel!

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.