lsof

Cindy Sridharan
Mar 13, 2017 · 10 min read

Options … an embarrassment of riches

NAMElsof - list open filesSYNOPSISlsof  [  -?abChKlnNOPRtUvVX  ]  [ -A A ] [ -c c ] [ +c c ] [ +|-d d ] [+|-D D ] [ +|-e s ] [ +|-f [cfgGn] ] [ -F [f] ] [ -g [s] ] [ -i [i] ] [-k  k  ]  [  +|-L  [l] ] [ +|-m m ] [ +|-M ] [ -o [o] ] [ -p s ] [ +|-r[t[m<fmt>]] ] [ -s [p:s] ] [ -S [t] ] [ -T [t] ] [ -u s ] [ +|-w ] [ -x[fl] ] [ -z [z] ] [ -Z [Z] ] [ -- ] [names]
cindy@ubuntu:~$ lsof -u cindy | wc -l248
cindy@ubuntu:~$ lsof -u^cindy | wc -l38193
cindy@ubuntu:~$ lsof -U | head -5COMMAND     PID       USER   FD   TYPE             DEVICE SIZE/OFF    NODE NAMEinit          1       root    7u  unix 0xffff88086a171f80      0t0   24598 @/com/ubuntu/upstartinit          1       root    9u  unix 0xffff88046a22b480      0t0   22701 socketinit          1       root   10u  unix 0xffff88086a351180      0t0   39003 @/com/ubuntu/upstartinit          1       root   11u  unix 0xffff880469006580      0t0   16510 @/com/ubuntu/upstart
cindy@ubuntu:~$ lsof -cpython | head -15COMMAND     PID USER   FD   TYPE             DEVICE SIZE/OFF       NODE NAMEpython2.7 16905 root  cwd    DIR                9,1     4096  271589387 /home/cindy/sourceboxpython2.7 16905 root  rtd    DIR                9,1     4096       2048 /python2.7 16905 root  txt    REG                9,1  3345416  268757001 /usr/bin/python2.7python2.7 16905 root  mem    REG                9,1    11152 1610852447 /usr/lib/python2.7/lib-dynload/resource.x86_64-linux-gnu.sopython2.7 16905 root  mem    REG                9,1   101240 1610899495 /lib/x86_64-linux-gnu/libresolv-2.19.sopython2.7 16905 root  mem    REG                9,1    22952 1610899509 /lib/x86_64-linux-gnu/libnss_dns-2.19.sopython2.7 16905 root  mem    REG                9,1    47712 1610899515 /lib/x86_64-linux-gnu/libnss_files-2.19.sopython2.7 16905 root  mem    REG                9,1    33448 1610852462 /usr/lib/python2.7/lib-dynload/_multiprocessing.x86_64-linux-gnu.sopython2.7 16905 root  mem    REG                9,1    54064 1610852477 /usr/lib/python2.7/lib-dynload/_json.x86_64-linux-gnu.sopython2.7 16905 root  mem    REG                9,1    18936 1610619044 /lib/x86_64-linux-gnu/libuuid.so.1.3.0python2.7 16905 root  mem    REG                9,1    30944 1207967802 /usr/lib/x86_64-linux-gnu/libffi.so.6.0.1python2.7 16905 root  mem    REG                9,1   136232 1610852472 /usr/lib/python2.7/lib-dynload/_ctypes.x86_64-linux-gnu.sopython2.7 16905 root  mem    REG                9,1    77752 1610852454 /usr/lib/python2.7/lib-dynload/parser.x86_64-linux-gnu.sopython2.7 16905 root  mem    REG                9,1   387256 1610620979 /lib/x86_64-linux-gnu/libssl.so.1.0.0
cindy@ubuntu:~$ lsof -cpython -c^python2.7 | head -10COMMAND   PID USER   FD   TYPE DEVICE SIZE/OFF       NODE NAMEpython  20017 root  cwd    DIR    9,1     4096       2048 /python  20017 root  rtd    DIR    9,1     4096       2048 /python  20017 root  txt    REG    9,1  3345416  268757001 /usr/bin/python2.7python  20017 root  mem    REG    9,1    11152 1610852447 /usr/lib/python2.7/lib-dynload/resource.x86_64-linux-gnu.sopython  20017 root  mem    REG    9,1     6256  805552236 /usr/lib/python2.7/dist-packages/_psutil_posix.x86_64-linux-gnu.sopython  20017 root  mem    REG    9,1    14768  805552237 /usr/lib/python2.7/dist-packages/_psutil_linux.x86_64-linux-gnu.sopython  20017 root  mem    REG    9,1    10592  805451779 /usr/lib/python2.7/dist-packages/Crypto/Util/strxor.x86_64-linux-gnu.sopython  20017 root  mem    REG    9,1    11176 1744859170 /usr/lib/python2.7/dist-packages/Crypto/Cipher/_ARC4.x86_64-linux-gnu.sopython  20017 root  mem    REG    9,1    23560 1744859162 /usr/lib/python2.7/dist-packages/Crypto/Cipher/_Blowfish.x86_64-linux-gnu.so
cindy@ubuntu:~$ lsof +d /usr/bin | head -4COMMAND     PID     USER  FD   TYPE DEVICE SIZE/OFF   NODE NAMEcircusd    1351     root txt    REG    9,1  3345416 268757001 /usr/bin/python2.7docker     1363     root txt    REG    9,1 19605520 270753792 /usr/bin/dockerrunsvdir   1597     root txt    REG    9,1    17144 272310314 /usr/bin/runsvdir
The list is an exclusion list if all entries of the set begin with '^'. It is an inclusion list if no entry begins with '^'. Mixed lists are not permitted.A file descriptor number range may be in the set as long as neither member is empty, both members are numbers, and the ending member is larger than the starting one - e.g., ''0-7'' or ''3-10''. Ranges may be specified for exclusion if they have the '^' prefix - e.g., ''^0-7'' excludes all file descriptors 0 through 7.Multiple file descriptor numbers are joined in a single ORed set beforeparticipating in AND option selection.When there are exclusion and inclusion members in the set,lsof reports them as errors and exits with a non-zero return code.
cindy@ubuntu:~$ lsof -t /var/log/dummy_svc.log1235
2171
2188
2189
16758
16761
16762

Combining Options

Normally list options that are specifically stated are ORed - i.e., specifying the -ioption without an address and the -ufoo option produces a listing of all network files OR files belonging to processes owned by user ''foo''. The exceptions are:1. the '^' (negated) login name or user ID (UID), specified with the -u option;
2. the '^' (negated) process ID (PID), specified with the -p option;
3. the '^' (negated) process group ID (PGID), specified with the -g option;
4. the '^' (negated) command, specified with the -c option;
5. the ('^') negated TCP or UDP protocol state names, specified with the -s [p:s] option.
Since they represent exclusions, they are applied without ORing or ANDing and take effect before any other selection criteria are applied.The -a option may be used to AND the selections. For example, specifying -a, -U, and -ufoo produces a listing of only UNIX socket files that belong to processes owned by user ''foo''.

A warstory … of sorts.

Conclusion

Cindy Sridharan

Written by

@copyconstruct on Twitter. views expressed on this blog are solely mine, not those of present or past employers.

Welcome to a place where words matter. On Medium, smart voices and original ideas take center stage - with no ads in sight. Watch
Follow all the topics you care about, and we’ll deliver the best stories for you to your homepage and inbox. Explore
Get unlimited access to the best stories on Medium — and support writers while you’re at it. Just $5/month. Upgrade