Lsof detailed explanation

Only ordinary root users can execute lsof commands. Ordinary users can see the / usr/sbin/lsof command, but ordinary users' execution will display "permission denied".

Let me summarize the usage of the lsof instruction:

Lsof `which httpd` # that process is using the executable file of apache

Lsof abc.txt shows the process of opening the file abc.txt

Lsof-I: 22 know what program port 22 is running now

Lsof-c abc displays the files now opened by the abc process

Lsof-g gid shows the process that belongs to the gid

Lsof + d / usr/local/ displays the files opened by the process in the directory

Lsof + D / usr/local/ is the same as above, but will search the directory under the directory for a long time.

Lsof-d 4 shows processes using fd 4

Lsof-I is used to display eligible processes.

Syntax: lsof-I [46] [protocol] [@ hostname | hostaddr] [: service | port]

46-> IPv4 or IPv6

Protocol-> TCP or UDP

Hostname-> Internet hostname

Hostaddr-> IPv4 location

Service name in service-> / etc/service (can be more than one)

Port-> port number (can be more than one)

Example: TCP:25-TCP and port 25

@ 1.2.3.4-Internet IPv4 host address 1.2.3.4

Tcp@o.ks.edu.tw:ftp-TCP protocol host.ks.edu.tw service name:ftp

Lsof-n does not convert IP to hostname. By default, the-n parameter is not added.

Example: lsof-I tcp@o.ks.edu.tw:ftp-n

Lsof-p 12 to see which files are opened by the process with process number 12

Lsof + |-r [t] controls the repeated execution of lsof. Default is 15s refresh.

-rrecoery lsof will be executed forever until the interrupt signal is received

+ rforce lsof will be executed until no files are displayed

Example: constantly check the current ftp connection: lsof-I tcp@o.ks.edu.tw:ftp-r

Lsof-s lists the size of the open file, leaving it blank if there is no size

Lsof-u username lists open files in UID