Shulou(Shulou.com)06/01 Report--

Learn the lsof command

The full name of lsof is list opened files, which lists the files that have been opened in the system. We all know that in a linux environment, everything is a file.

Devices are files, directories are files, and even sockets are files. Therefore, the good use of lsof commands is very helpful to day-to-day linux management.

Lsof is one of the most commonly used commands in linux, and the usual output format is:

Quote

COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME

Common fields include the following: more visible manual.

1 、 COMMAND

The name of the command that is displayed by default at a length of 9 characters. You can use the + c parameter to specify the width of the display, and if the argument followed by + c is zero, the full name of the command is displayed.

2. PID: the ID number of the process

3 、 PPID

The IP number of the parent process, which is not displayed by default, can be turned on when using the-R parameter.

4 、 PGID

The ID number of the process group, which is not displayed by default, can be turned on when the-g parameter is used.

5 、 USER

The UID of the execution of the command or the name of the user logged in in the system. The default is the user name, and UID can be displayed when the-l parameter is used.

6 、 FD

Is the File Descriptor number of the file, or something like this:

(it is difficult to translate the corresponding meaning here, keep it in English)

Quote

Cwd current working directory

Lnn library references (AIX)

Jld jail directory (FreeBSD)

Ltx shared library text (code and data)

Mxx hex memory-mapped type number xx.

M86 DOS Merge mapped file

Mem memory-mapped file

Mmap memory-mapped device

Pd parent directory

Rtd root directory

Tr kernel trace file (OpenBSD)

Txt program text (code and data)

V86 VP/ix mapped file

The File Descriptor number display modes of the file are:

Quote

R for read access

W for write access

U for read and write access

N for a Solaris NFS lock of unknown type

R for read lock on part of the file

R for a read lock on the entire file

W for a write lock on part of the file

W for a write lock on the entire file

U for a read and write lock of any length

U for a lock of unknown type

X for an SCO OpenServer Xenix lock on part of the file

X for an SCO OpenServer Xenix lock on the entire file

Space if there is no lock.

7 、 TYPE

Quote

IPv4 IPv4's bag.

IPv6 uses packets in IPv6 format, and even if the address is IPv4, it will be displayed as IPv6, while the address mapped to IPv6

DIR directory

LINK link file

Please see more comments in manual for details.

8 、 DEVICE

Device number represented by character special and block special

9 、 SIZE

The size of the file, if not represented by size, will be left blank. Use the-s parameter control.

10 、 NODE

Node code of the local file, or protocol, such as TCP, etc.

11 、 NAME

The full path of the mount point and the file (the link will be resolved to the actual path), or the address, port, status, etc., of both parties connected.

Common examples:

1. Show the process of opening the file / home/oracle/10.2.0/db_1/bin/tnslsnr

[root@svr-db-test ~] # lsof / home/oracle/10.2.0/db_1/bin/tnslsnr

COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME

Tnslsnr 3520 oracle txt REG 253,5 431062 11408866 / home/oracle/10.2.0/db_1/bin/tnslsnr

two。 Know what program port 22 is running now.

[root@svr-db-test] # lsof-I: 22

COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME

Sshd 3101 root 3U IPv6 8670 TCP *: ssh (LISTEN)

Sshd 4545 root 3u IPv6 4237972 TCP 203.aibo.com win-avbmq9e8ka7.gdgg.local:nsjtp-ctrl (ESTABLISHED)

3. Displays the files now opened by the init process

[root@svr-db-test ~] # lsof-c init

COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME

Init 1 root cwd DIR 253,0 4096 2 /

Init 1 root rtd DIR 253,0 4096 2 /

Init 1 root txt REG 253,0 43496 524446 / sbin/init

Init 1 root mem REG 253,0 130448 917826 / lib64/ld-2.5.so

Init 1 root mem REG 253,0 1678480 917827 / lib64/libc-2.5.so

Init 1 root mem REG 253,0 23520 917686 / lib64/libdl-2.5.so

Init 1 root mem REG 253,0 247528 917844 / lib64/libsepol.so.1

Init 1 root mem REG 253,0 95480 917845 / lib64/libselinux.so.1

Init 1 root 10u FIFO 0,16 2311 / dev/initctl

4. See which files are opened by the process with process number 1

[root@svr-db-test ~] # lsof-p 1

COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME

Init 1 root cwd DIR 253,0 4096 2 /

Init 1 root rtd DIR 253,0 4096 2 /

Init 1 root txt REG 253,0 43496 524446 / sbin/init

Init 1 root mem REG 253,0 130448 917826 / lib64/ld-2.5.so

Init 1 root mem REG 253,0 1678480 917827 / lib64/libc-2.5.so

Init 1 root mem REG 253,0 23520 917686 / lib64/libdl-2.5.so

Init 1 root mem REG 253,0 247528 917844 / lib64/libsepol.so.1

Init 1 root mem REG 253,0 95480 917845 / lib64/libselinux.so.1

Init 1 root 10u FIFO 0,16 2311 / dev/initctl

5. Show the process that belongs to 3520

[root@svr-db-test ~] # lsof-g 3520

COMMAND PID PGID USER FD TYPE DEVICE SIZE NODE NAME

Tnslsnr 3520 3520 oracle cwd DIR 253,5 4096 11059201 / home/oracle

Tnslsnr 3520 3520 oracle rtd DIR 253,0 4096 2 /

Tnslsnr 3520 3520 oracle txt REG 253,5 431062 11408866 / home/oracle/10.2.0/db_1/bin/tnslsnr

Tnslsnr 3520 3520 oracle mem REG 253,0 130448 917826 / lib64/ld-2.5.so

Tnslsnr 3520 3520 oracle mem REG 253,0 1678480 917827 / lib64/libc-2.5.so

Tnslsnr 3520 3520 oracle mem REG 253,0 23520 917686 / lib64/libdl-2.5.so

Tnslsnr 3520 3520 oracle mem REG 253,0 615136 917834 / lib64/libm-2.5.so

Tnslsnr 3520 3520 oracle mem REG 253,0 141208 917829 / lib64/libpthread-2.5.so

Tnslsnr 3520 3520 oracle mem REG 253,0 109824 917839 / lib64/libnsl-2.5.so

Tnslsnr 3520 3520 oracle mem REG 253,5 20706622 11405436 / home/oracle/10.2.0/db_1/lib/libclntsh.so.10.1

Tnslsnr 3520 3520 oracle mem REG 253,5 3803097 11410641 / home/oracle/10.2.0/db_1/lib/libnnz10.so

Tnslsnr 3520 3520 oracle mem REG 253,5 83493 11407251 / home/oracle/10.2.0/db_1/lib/libons.so

Tnslsnr 3520 3520 oracle mem REG 253,0 53880 917532 / lib64/libnss_files-2.5.so

Tnslsnr 3520 3520 oracle mem REG 253,5 8545 11407615 / home/oracle/10.2.0/db_1/lib/libskgxn2.so

Tnslsnr 3520 3520 oracle mem REG 253,5 513705 11410332 / home/oracle/10.2.0/db_1/lib/libocrutl10.so

Tnslsnr 3520 3520 oracle mem REG 253,5 636161 11410330 / home/oracle/10.2.0/db_1/lib/libocr10.so

Tnslsnr 3520 3520 oracle mem REG 253,5 657825 11410331 / home/oracle/10.2.0/db_1/lib/libocrb10.so

Tnslsnr 3520 3520 oracle mem REG 253,5 1745769 11410365 / home/oracle/10.2.0/db_1/lib/libhasgen10.so

Tnslsnr 3520 3520 oracle mem REG 253,5 61985 11410366 / home/oracle/10.2.0/db_1/lib/libclsra10.so

Tnslsnr 3520 3520 oracle 0u CHR 1,3 2553 / dev/null

Tnslsnr 3520 3520 oracle 1u CHR 1,3 2553 / dev/null

Tnslsnr 3520 3520 oracle 2u CHR 1,3 2553 / dev/null

Tnslsnr 3520 3520 oracle 3w REG 253,5 318853012 11633459 / home/oracle/10.2.0/db_1/network/log/listener.log

Tnslsnr 3520 3520 oracle 4r FIFO 0,6 15661 pipe

Tnslsnr 3520 3520 oracle 5r REG 253,5 11776 11410579 / home/oracle/10.2.0/db_1/network/mesg/nlus.msb

Tnslsnr 3520 3520 oracle 6r REG 253,5 46592 11407160 / home/oracle/10.2.0/db_1/network/mesg/tnsus.msb

Tnslsnr 3520 3520 oracle 7w FIFO 0,6 15662 pipe

Tnslsnr 3520 3520 oracle 8u IPv4 15665 TCP 203.aibo.com:ncube-lm (LISTEN)

Tnslsnr 3520 3520 oracle 9u unix 0xffff81021b7d6980 15666 / var/tmp/.oracle/s#3520.1

Tnslsnr 3520 3520 oracle 10u unix 0xffff81021b7d66c0 15668 / var/tmp/.oracle/s#3520.2

6. Search by folder / home/oracle, but will not open the subdirectory to display the files opened by the process in the directory

[root@svr-db-test ~] # lsof + d / home/oracle

COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME

Tnslsnr 3520 oracle cwd DIR 253,5 4096 11059201 / home/oracle

7. Open the / home/oracle folder and its subdirectory search to display the files opened by the process in the directory

[root@svr-db-test ~] # lsof + D / home/oracle

There is too much content to display.

8. Lsof-I is used to display eligible processes

Syntax: lsof-I [46] [protocol] [@ hostname | hostaddr] [: service | port]

46-- > IPv4 or IPv6

Protocol-- > TCP or UDP

Hostname-- > Internet hostname

Hostaddr-- > IPv4 location

Service name in service-- > / etc/service (can be more than one)

Port-- > port number (can be more than one)

Example:

[root@svr-db-test] # lsof-I tcp@192.168.2.245:1521-n

COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME

Oracle 15633 oracle 16u IPv4 4069605 TCP 192.168.2.203 IPv4 31580-> 192.168.2.245:ncube-lm (ESTABLISHED)

Or

[root@svr-db-test] # lsof-I tcp@192.168.2.245:1521

COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME

Oracle 15633 oracle 16u IPv4 4069605 TCP 203.aibo.com IPv4 31580-> 192.168.2.245:ncube-lm (ESTABLISHED)

Lsof-n does not convert IP to hostname. By default, the-n parameter is not added.

9. Displays a user's open file (or a file that has been opened by the user's executor)

[root@svr-db-test] # lsof-u oracle

Or

[root@svr-db-test ~] # lsof-u 0

10. Print only process to facilitate shell script call

[root@svr-db-test ~] # lsof-tc sshd

3101

4545

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.