Shulou(Shulou.com)06/02 Report--

In this issue, the editor will bring you about how to use the lsof command in Linux. The article is rich in content and analyzes and narrates it from a professional point of view. I hope you can get something after reading this article.

Lsof command is an extension tool of Linux system, which means list opened filedesciptor (list the file descriptors that have been opened). In Linux system, all things related to resource handles can be abstracted into file descriptors (filedescriptor, referred to as fd). A file handle is a fd, a socket object can also be called fd, and so on.

By default, this command does not exist on the system. You need to install it, using the following command:

Yum install lsof

Let's take a look at the effect of this command:

COMMAND PID TID USER FD TYPE DEVICE SIZE/OFF NODE NAMEsystemd 1 root cwd DIR 202,1 4096 2 / nscd 453 469 nscd 8u netlink 0t0 11017 ROUTEnscd 453 470 nscd cwd DIR 202,1 4096 2 / nscd 453 470 nscd rtd DIR 202,1 4096 2 / nscd 453 470 nscd txt REG 202,1 180272 146455 / usr/sbin/nscdnscd 453 470 nscd mem REG 202,1 217032 401548 / var/db/nscd/hostsnscd 453 470 nscd mem REG 202,1 90664 132818 / usr/ Lib64/libz.so.1.2.7nscd 453 470 nscd mem REG 202,1 68192 133155 / usr/lib64/libbz2.so.1.0.6nscd 453 470 nscd mem REG 202,1 153192 133002 / usr/lib64/liblzma.so.5.0.99nscd 453 470 nscd mem REG 202,1 91496 133088 nscd 453 471 nscd 5u a_inode 0,9 0 4796 [eventpoll] nscd 453 471 nscd 6r REG 202,1 217032 401548 / var/db/nscd/hostsnscd 453 471 nscd 7u unix 0xffff880037497440 0t0 11015 / var/run/nscd/socketnscd 453 471 nscd 8u netlink 0t0 11017 ROUTEimgserver 611 zhangyl cwd DIR 202,1 4096 1059054 / home/zhangyl/flamingoserverimgserver 611 zhangyl rtd DIR 202,1 4096 2 / imgserver 611 zhangyl txt REG 202,1 4788917 1057044 / home/zhangyl/flamingoserver/imgserverimgserver 611 zhangyl 24u a_inode 0,9 0 4796 [eventfd] imgserver 611 zhangyl 25u IPv4 55707643 0t0 TCP *: commtact-http (LISTEN) imgserver 611 zhangyl 26r CHR 1 0t0 4800 / dev/nullimgserver 611 613 zhangyl 32w REG 202 131072 2754609 / home/zhangyl/flamingoserver/imgcache/258bfb8945288a117d98d440986d7a03

The various fd types opened by each process are listed in the result display, and the detailed path is shown for the Uinx Socket,lsof command, as is the open file fd.

There are three things to note when using the lsof command:

By default, lsof has more output, so we can use the grep command to filter the fd information opened by the process we want to view, such as:

Lsof-I | grep myapp

Or you can use lsof-p pid to filter out the fd information opened by the specified process:

[root@iZ238vnojlyZ] # lsof-p 26621COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAMEchatserve 26621 zhangyl cwd DIR 202, 1 4096 1059054 / home/zhangyl/flamingoserverchatserve 26621 zhangyl rtd DIR 202, 1 4096 2 / chatserve 26621 zhangyl txt REG 202, 1 8027035 1051942 / home/zhangyl/flamingoserver/chatserverchatserve 26621 zhangyl mem REG 202, 1 61928 141417 / usr/lib64/libnss_files-2.17.sochatserve 26621 zhangyl mem REG 202 44096 143235 / usr/lib64/librt-2.17.sochatserve 26621 zhangyl mem REG 202 usr/lib64/libdl-2.17.sochatserve 1 19520 137064 / usr/lib64/libdl-2.17.sochatserve 26621 zhangyl mem REG 202 zhangyl 1 2112384 132824 / usr/lib64/libc-2.17.sochatserve 26621 zhangyl mem REG 202 142304 132850 / usr/lib64/libpthread-2.17.sochatserve 26621 zhangyl mem REG 202 zhangyl Mem REG 202,1 1141560 137077 / usr/lib64/libm-2.17.sochatserve 26621 zhangyl mem REG 202,1 999944 140059 / usr/lib64/libstdc++.so.6.0.19chatserve 26621 zhangyl mem REG 202,1 9879756 269001 / usr/lib64/mysql/libmysqlclient.so.20.3.4chatserve 26621 zhangyl mem REG 202,1 164440 133622 / usr/lib64/ld-2.17.sochatserve 26621 zhangyl 0u CHR 1,3 0t0 4800 / dev/nullchatserve 26621 zhangyl 1u CHR 1,3 0t0 4800 / dev/nullchatserve 26621 zhangyl 2u CHR 1,3 0t0 4800 / dev/nullchatserve 26621 zhangyl 3u a_inode 0,9 0 4796 [eventpoll] chatserve 26621 zhangyl 4u a_inode 0,9 0 4796 [timerfd] chatserve 26621 zhangyl 5u a_inode 0,9 0 4796 [eventfd] chatserve 26621 zhangyl 7u a_inode 0,9 0 4796 [eventpoll]

The lsof command can only view the process fd information that the current user has permission to see. For processes that do not have permission, the rightmost column displays "Permission denied". As follows:

Sshd 26759 root cwd unknown / proc/26759/cwd (readlink: Permission denied) sshd 26759 root rtd unknown / proc/26759/root (readlink: Permission denied) sshd 26759 root txt unknown / proc/26759/exe (readlink: Permission denied) sshd 26759 root NOFD / proc/26759/fd (opendir: Permission denied) bash 26761 root cwd unknown / proc/26761/cwd (readlink: Permission denied) bash 26761 root rtd unknown / proc/26761/root (readlink: Permission denied) bash 26761 root txt unknown / proc/26761/exe (readlink: Permission denied) bash 26761 root NOFD / proc/26761/fd (opendir: Permission denied)

When the process name in the first column of the lsof command is displayed, the first n characters are displayed by default, so if we need to display the full process name for easy filtering, we can use the + c option. The usage is as follows:

# the leftmost program name displays a maximum of 15 characters [zhangyl@iZ238vnojlyZ ~] $lsof + c 15

Of course, if you set the value too high, lsof will not use the maximum value you set, but will use the default maximum value.

As mentioned above, socket is also a kind of fd. If you need to display only the network connection information of the system, you can use the-I option, which can vividly show the current access connection of the system:

See the connection direction in the picture?

Of course, like the netstat command, lsof-I displays aliases for ip address and port number by default, and we only need to use the-n and-P options to display ip address and port number accordingly, which is lsof-Pni:

What is Linux system Linux is a free-to-use and free-spread UNIX-like operating system, is a POSIX-based multi-user, multi-task, multi-threaded and multi-CPU operating system, using Linux can run major Unix tools, applications and network protocols.

This is how the lsof command in Linux shared by Xiaobian is used. If you happen to have similar doubts, you might as well refer to the above analysis to understand. If you want to know more about it, you are welcome to follow the industry information channel.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.