Shulou(Shulou.com)06/01 Report--

This article mainly explains the "installation and basic operation of Lsof commands under Linux". The explanation in the article is simple and clear and easy to learn and understand. Please follow the editor's train of thought to study and learn "the installation and basic operation of Lsof commands under Linux".

Installation

The lsof command is not installed by default, and its use requires root permission or general sudo permission. Install it using the following command

Yum install-y lsof

The lsof command has many optional parameters. This article collates some common and important uses based on my own experience.

List all open files

Executing the lsof command without any parameters outputs all files opened by all currently active processes

[root@ecs-centos-7 ~] # lsof | more COMMAND PID TID USER FD TYPE DEVICE SIZE/OFF NODE NAME systemd 1 root cwd DIR 253 1 4096 2 / systemd 1 root rtd DIR 253 1 4096 2 / systemd 1 root txt REG 253,1 1624520 530313 / usr/lib/systemd/systemd systemd 1 root mem REG 253,1 20064 528340 / usr/lib64/libuuid.so.1.3.0 systemd 1 root mem REG 253,1 265600 532853 / usr/lib64/libblkid.so.1.1.0 systemd 1 root mem REG 253,1 90248 525942 / usr/lib64/libz.so.1.2.7 systemd 1 root mem REG 253,1 157424 525955 / usr/lib64/liblzma.so.5.2.2 systemd 1 root mem REG 253,1 23968 526159 / usr/lib64/libcap-ng.so.0.0.0 systemd 1 root mem REG 253,1 19896 526135 / usr/lib64/libattr.so.1.1.0 systemd 1 root mem REG 253,1 19288 525996 / usr/lib64/libdl-2.17.so systemd 1 root mem REG 253,1 402384 525931 / usr/lib64/libpcre.so.1.2.0 systemd 1 Root mem REG 253,1 2156160

Since the lsof command outputs a lot of information, lsof | more is used in the above example to display the command output by page.

In the output, the process ID of systemd in the first column is 1, which is a daemon

The columns COMMAND, PID and USER represent the process name, process ID and user, respectively.

The column FD is the file descriptor. Here are the possible types and descriptions

FD description cwd current directory txttxt files rtdroot directories mem memory mapping files

Column TYPE is the file type. Here are the possible values and descriptions

TYPE description DIR directory REG normal file CHR character a_inodeInode file FIFO pipe or socket file netlink network unknown unknown

The column DEVICE represents the device ID

The column SIZE/OFF represents the process size

The column NODE represents the Inode number of the file

The column NAME represents a path or link

Lists files that have been opened by the specified user

Use the-u option to list the files that have been opened by the specified user, which can be followed by multiple user names, each separated by a space, indicating that all files that have been opened by the specified user are listed

TYPE description DIR directory REG normal file CHR character a_inode Inode file FIFO pipe or socket file netlink network unknown unknown

In the above example, the lsof-u tt command lists the files that have been opened by the tt user. As you can see from the results, the user has opened the files / home/tt, /, / usr/bin/bash, / usr/bin/vim, / home/tt/.p.txt.swp.

If you want to exclude files that have been opened by the specified user, you can add the ^ symbol before the user name, and the following command lists the files that have been opened by all users except the tt user

Lsof-u ^ tt | more

Find files that are open but have been deleted

There is a scenario in which a service is writing a log in a log file. At this time, the log file being written is accidentally deleted.

In the above scenario, although the log file has been deleted, the file is still open, and it still takes up space in the file system. We can use the grep command to find out which files are open but have been deleted.

[root@ecs-centos-7 ~] # lsof-u tt | grep deleted vim 27813 tt 4U REG 253 1 12288 131167 / home/tt/.p.txt.swp (deleted)

In the above example, use the lsof-u tt | grep deleted command to view the files that are actually deleted opened by the user tt

As can be seen from the results, when writing to p.txt, the file was deleted

List all open network files

[root@ecs-centos-7] # lsof-i COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME ntpd 567 ntp 18u IPv4 12657 0t0 UDP localhost:ntp ntpd 567 ntp 22u IPv6 16095 0t0 UDP ecs-centos-7.4-64bit-20200212:ntp dhclient 651 root 6u IPv4 14594 0t0 UDP *: bootpc master 960 root 13u IPv4 15791 0t0 TCP localhost:smtp (LISTEN) master 960 root 14u IPv6 15792 0t0 TCP localhost:smtp (LISTEN) mysqld 1053 mysql 13u IPv6 15147 0t0 TCP *: mysql (LISTEN) sshd 1348 root 3U IPv4 16698 0t0 TCP *: ssh (LISTEN)

List all IPV4/6 network files

List all ipv4 network files that have been opened

[root@ecs-centos-7] # lsof-I 4 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME ntpd 567 ntp 16u IPv4 12651 0t0 UDP *: ntp ntpd 567 ntp 18u IPv4 12657 0t0 UDP localhost:ntp ntpd 567 ntp 21U IPv4 16094 0t0 UDP ecs-centos-7.4-64bit-20200212:ntp dhclient root 6u IPv4 14594 0t0 UDP *: bootpc master 960 root 13u IPv4 15791 0t0 TCP localhost: Smtp (LISTEN) sshd 1348 root 3U IPv4 16698 0t0 TCP *: ssh (LISTEN)

All ipv6 network files that have been opened

[root@ecs-centos-7] # lsof-I 6 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME ntpd 567 ntp 17u IPv6 12652 0t0 UDP *: ntp ntpd 567 ntp 19u IPv6 12658 0t0 UDP localhost:ntp ntpd 567 ntp 22u IPv6 16095 0t0 UDP ecs-centos-7.4-64bit-20200212:ntp master 960 root 14u IPv6 15792 0t0 TCP localhost:smtp (LISTEN) mysqld 1053 mysql 13u IPv6 15147 0t0 TCP *: Mysql (LISTEN) sshd 1348 root 4U IPv6 16700 0t0 TCP *: ssh (LISTEN)

Lists the files opened on the specified port

Use lsof-I: Port number to get all files opened on the specified port number

[root@ecs-centos-7] # lsof-iVera 22 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME sshd 1348 root 3u IPv4 16698 0t0 TCP *: ssh (LISTEN) sshd 1348 root 4U IPv6 16700 0t0 TCP *: ssh (LISTEN) sshd 27741 root 3u IPv4 458958 0t0 TCP ecs-centos-7.4-64bitMutual 20212root SSH-> 113.118.121.220 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME sshd 42395 (ESTABLISHED) sshd 27819 root 3u IPv4 459250 0t0 TCP ecs- Centos-7.4-64bit root 20200212 12 root SSH-> 113.118.121.220 sshd 19807 (ESTABLISHED) root 3u IPv4 459828 0t0 TCP

The above example lists all the files opened on port 22

In server development, a gateway or agent is often deployed to communicate with the client. The gateway or agent needs to open a fixed port for the client to connect.

If the client cannot connect to the gateway or agent, we can use the above command to check whether the port of the gateway or agent is open, so as to eliminate the situation that the gateway cannot be connected because the port is closed.

Lists files that use the specified protocol (TCP/UDP)

Use lsof-I TCP/UDP to list files that use the TCP or UDP protocol

[root@cghost8 / home/cgyx] # lsof-I TCP | more COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME sshd 1704 root 3u IPv4 13593 0t0 TCP *: ssh (LISTEN) sshd 1704 root 4u IPv6 13595 0t0 TCP *: ssh (LISTEN) redis-serer 1725 root 4u IPv4 19773 0t0 TCP localhost:6380 (LISTEN) nc 2067 cgyx 4u IPv4 39167 0t0 TCP *: 60600 (LISTEN) ) mysqld 3020 mysql 4U IPv6 5514608 0t0 TCP 192.168.70.10 IPv6 mysql-> 192.168.70.10 IPv6 37084 (ESTABLISHED)

Use lsof-I TCP:3306 to list files that use the TCP protocol and port 3306

[root@cghost8 / home/cgyx] # lsof-I TCP:3306 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME mysqld 3020 mysql 4U IPv6 5514608 0t0 TCP 192.168.70.10 lsof mysql-> 192.168.70.10 lsof 37084 (ESTABLISHED)

Use lsof-I TCP:1-1024 to list files that use the TCP protocol and port ranges from 1 to 1024

[root@cghost8 / home/cgyx] # lsof-I TCP:1-1024 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME sshd 1704 root 3u IPv4 13593 0t0 TCP *: ssh (LISTEN) sshd 1704 root 4U IPv6 13595 0t0 TCP *: ssh (LISTEN) cupsd 1709 root 12u IPv6 39148 0t0 TCP localhost:ipp (LISTEN) cupsd 1709 root 13u IPv4 39149 0t0 TCP localhost:ipp (LISTEN) smbd 1824 Root 35U IPv6 17658 0t0 TCP *: microsoft-ds (LISTEN) smbd 1824 root 36U IPv6 17659 0t0 TCP *: netbios-ssn (LISTEN) smbd 1824 root 37u IPv4 17660 0t0 TCP *: microsoft-ds (LISTEN) smbd 1824 root 38U IPv4 17661 0t0 TCP *: netbios-ssn (LISTEN)

List all open files in the directory

You can use the lsof command to list all open files in a specified directory

There is a data directory with the following structure:

[root@ecs-centos-7 tt] # tree data/ data/ ├── dira │ └── a.txt └── d.s 1 directory, 2 files

List the open files in the data directory

[root@ecs-centos-7 tt] # lsof + D. / data/ COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME bash 28473 root cwd DIR 253 1 4096 131146. / data bash 28502 root cwd DIR 253 data/dira/.a.txt.swp 1 4096 131172. / data/dira vim 28530 root cwd DIR 253 root 1 4096 131172. / data/dira vim 28530 root 4u REG 253 12288 131174. / data/dira/.a.txt.swp [root@ecs-centos-7 tt] # lsof + d. / data/ COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME bash 28473 root cwd DIR 253 data bash 1 4096 131146. / data bash 28502 root cwd DIR 253 root cwd DIR 253 4096 131172. / data/dira vim 28530 root cwd DIR 253 14096 131172. / data/dira

In the above example, both the + D and + d options list the files opened in the directory

The + D option lists open files in a directory and its subdirectories, while the + d option lists only open files in the current directory.

Lists the files opened by the specified process ID

The process ID is the unique identity of the operating system process. The following command lists the files related to the process ID of 1053. From the results, you can know that the process ID corresponds to MySQL.

[root@ecs-centos-7] # lsof-p 1053 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME mysqld 1053 mysql cwd DIR 253 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME mysqld 1 4096 1055765 / var/lib/mysql mysqld 1053 mysql rtd DIR 253 people 1 4096 2 / mysqld 1053 mysql txt REG 253 usr/sbin/mysqld mysqld 534935 / usr/sbin/mysqld mysqld 1053 mysql mem REG 253 usr/lib64 1 209512 659436 / usr/lib64 / mysql/plugin/validate_password.so mysqld 1053 mysql 1w REG 253,1 206658 924771 / var/log/mysqld.log mysqld 1053 mysql 2w REG 253,1 206658 924771 / var/log/mysqld.log

In the above command, multiple process ID can be specified after the-p option, and each process ID is separated by a comma. If you want to exclude files opened by a process, you can add the ^ symbol before the process ID.

Lsof-p 1, 2, 3, ^ 4

The above command lists all files opened by processes 1, 2, and 3, while ignoring files opened by process 4

Kill all processes of the specified user

The previous introduction lists all the open files of the specified user. We can use the kill command together to achieve the function of killing all processes of the specified user. The specific commands are as follows

Kill-9 `lsof-t-u tt`

In the above command, lsof-u tt lists all the files opened by the tt user. Adding the-t option indicates that the result only lists the PID column, that is, the process ID column, while the other columns are ignored. The previous kill-9 indicates the forced termination of the specified process ID.

Thank you for reading, the above is the content of "installation and basic operation of Lsof commands under Linux". After the study of this article, I believe you have a deeper understanding of the installation and basic operation of Lsof commands under Linux, and the specific use needs to be verified in practice. Here is, the editor will push for you more related knowledge points of the article, welcome to follow!

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.