Tuesday, March 21, 2017

lsof command exapmles in linux ?

lsof a utility command every system admin and developer love. The lsof command stands for list open file descriptors and as the name suggest, it is used to find open files by process. Since almost everything in UNIX are file, you can use lsof command to find an open regular file, a directory, a symbolic link, a block special file, a NFS mounted file, a socket stream, a shared library, a character special file, a regular pipe, a named pipe, an internet socket, a UNIX domain socket and many others. It's an incredibly useful tool to do debugging and troubleshooting in UNIX and Linux environment. Since most of the production system runs on the UNIX-based operating system, knowledge of this tool become even more important.


lsof command generally comes pre-installed in many UNIX system. If you are getting -bash: lsof: command not found an error while using lsof then it could be that lsof is not in your PATH. just check /usr/bin or /usr/sbin folder for this command. If you don't find there then you can install it from source or you can ask your UNIX admin to do that for you.

1)      How to list all open files by all process

syntax: lsof

Simply running lsof without any argument print all opened file and process. This is not particularly useful but a good starting point.

Example:

dev@linuxforfreshers.com:~$ lsof | tail -10
tail      23119                  dev   1u      CHR             136,52       0t0       55 /dev/pts/52
tail      23119                  dev   2u      CHR             136,52       0t0       55 /dev/pts/52
lsof      23120                  dev cwd       DIR                8,6      4096  5767170 /home/dev
lsof      23120                  dev rtd       DIR                8,6      4096        2 /
lsof      23120                  dev txt       REG                8,6    163224 28574379 /usr/bin/lsof
lsof      23120                  dev mem       REG                8,6   7216688 28580440 /usr/lib/locale/locale-archive
lsof      23120                  dev mem       REG                8,6   1840928  2622444 /lib/x86_64-linux-gnu/libc-2.19.so
lsof      23120                  dev mem       REG                8,6    149120  2622402 /lib/x86_64-linux-gnu/ld-2.19.so
lsof      23120                  dev   4r     FIFO               0,10       0t0  2094341 pipe
lsof      23120                  dev   7w     FIFO               0,10       0t0  2094342 pipe

2) How to list all process which has opened a file

Syntax: lsof /home/someuser/somefile

will list all the process which has opened this file. you can see the command, PID, user and full file path to find out the process.

Example:

dev@linuxforfreshers.com:~$ lsof /home/dev/ | grep ssh
ssh        8222 dev cwd    DIR    8,6     4096 5767170 /home/dev
ssh.expec  8266 dev cwd    DIR    8,6     4096 5767170 /home/dev
ssh.expec  8268 dev cwd    DIR    8,6     4096 5767170 /home/dev
ssh.expec  8274 dev cwd    DIR    8,6     4096 5767170 /home/dev

3) How to find all opened files by a user

You can use lsof -u command to list all opened file by a user as shown below
Syntax: lsof -u username

Example:          

dev@linuxforfreshers.com:~$ lsof -u dev| tail -10
lsof      23353 dev txt       REG                8,6    163224 28574379 /usr/bin/lsof
lsof      23353 dev mem       REG                8,6     43616  2622456 /lib/x86_64-linux-gnu/libnss_files-2.19.so
lsof      23353 dev mem       REG                8,6     47760  2622438 /lib/x86_64-linux-gnu/libnss_nis-2.19.so
lsof      23353 dev mem       REG                8,6     97296  2622400 /lib/x86_64-linux-gnu/libnsl-2.19.so
lsof      23353 dev mem       REG                8,6     39824  2622399 /lib/x86_64-linux-gnu/libnss_compat-2.19.so
lsof      23353 dev mem       REG                8,6   7216688 28580440 /usr/lib/locale/locale-archive
lsof      23353 dev mem       REG                8,6   1840928  2622444 /lib/x86_64-linux-gnu/libc-2.19.so
lsof      23353 dev mem       REG                8,6    149120  2622402 /lib/x86_64-linux-gnu/ld-2.19.so
lsof      23353 dev   4r     FIFO               0,10       0t0  2119980 pipe
lsof      23353 dev   7w     FIFO               0,10       0t0  2119981 pipe

4) How to list all files opened by a particular command
You can use lsof -c option to provide name of command and list down all the files opened by that command, for example, to list all file opened by mysql process, you can do this :
Syntax : lsof -c process_name


Example :
root@linuxforfreshers.com:~# lsof -c mysql | tail -10
lsof: WARNING: can't stat() fuse.gvfsd-fuse file system /run/user/1000/gvfs
      Output information may be incomplete.
mysqld  2149 mysql   54u   REG                8,6     1024 16515193 /var/lib/mysql/mysql/time_zone.MYI
mysqld  2149 mysql   55u   REG                8,6        0 16515194 /var/lib/mysql/mysql/time_zone.MYD
mysqld  2149 mysql   56u   REG                8,6     1024 16515202 /var/lib/mysql/mysql/time_zone_leap_second.MYI
mysqld  2149 mysql   57u   REG                8,6        0 16515203 /var/lib/mysql/mysql/time_zone_leap_second.MYD
mysqld  2149 mysql   58u   REG                8,6     1024 16515190 /var/lib/mysql/mysql/time_zone_name.MYI
mysqld  2149 mysql   59u   REG                8,6        0 16515191 /var/lib/mysql/mysql/time_zone_name.MYD
mysqld  2149 mysql   60u   REG                8,6     1024 16515196 /var/lib/mysql/mysql/time_zone_transition.MYI
mysqld  2149 mysql   61u   REG                8,6        0 16515197 /var/lib/mysql/mysql/time_zone_transition.MYD
mysqld  2149 mysql   62u   REG                8,6     1024 16515199 /var/lib/mysql/mysql/time_zone_transition_type.MYI
mysqld  2149 mysql   63u   REG                8,6        0 16515200 /var/lib/mysql/mysql/time_zone_transition_type.MYD

Example 2:
root@linuxforfreshers.com:~# lsof -c chrome| tail -10
lsof: WARNING: can't stat() fuse.gvfsd-fuse file system /run/user/1000/gvfs
      Output information may be incomplete.
chrome  22949 dev  74u      REG               0,22   4198400      167 /run/shm/.com.google.Chrome.frd729 (deleted)
chrome  22949 dev  75r      REG                8,6    333900  3670118 /usr/share/fonts/truetype/msttcorefonts/Times_New_Roman_Bold.ttf
chrome  22949 dev  78r      REG                8,6    123828  3670122 /usr/share/fonts/truetype/msttcorefonts/Trebuchet_MS_Bold.ttf
chrome  22949 dev  79r      REG                8,6    136032  3670125 /usr/share/fonts/truetype/msttcorefonts/Verdana_Bold.ttf
chrome  22949 dev  80u      REG               0,22   4198400       27 /run/shm/.com.google.Chrome.reBCyQ (deleted)
chrome  22949 dev  81r      REG                8,6    123828  3670122 /usr/share/fonts/truetype/msttcorefonts/Trebuchet_MS_Bold.ttf
chrome  22949 dev  86u      REG               0,22   4198400      172 /run/shm/.com.google.Chrome.opHb4S (deleted)
chrome  22949 dev  87r      REG                8,6    330412  3670117 /usr/share/fonts/truetype/msttcorefonts/Times_New_Roman.ttf
chrome  22949 dev  90r      REG                8,6    330412  3670117 /usr/share/fonts/truetype/msttcorefonts/Times_New_Roman.ttf
chrome  22949 dev 104u      REG               0,22   4198400      193 /run/shm/.com.google.Chrome.Y05n64 (deleted)

5) How to find all files opened by a particular user and command

You can combine users and process name in one lsof command to list down all the files opened by a particular process or a particular user as shown below :

Syntax: $ lsof -u dev -c chrome

root@linuxforfreshers.com:~# lsof -u dev-c chrome | tail -10
lsof: WARNING: can't stat() fuse.gvfsd-fuse file system /run/user/1000/gvfs
      Output information may be incomplete.
chrome    22949 dev  74u      REG               0,22   4198400      167 /run/shm/.com.google.Chrome.frd729 (deleted)
chrome    22949 dev  75r      REG                8,6    333900  3670118 /usr/share/fonts/truetype/msttcorefonts/Times_New_Roman_Bold.ttf
chrome    22949 dev  78r      REG                8,6    123828  3670122 /usr/share/fonts/truetype/msttcorefonts/Trebuchet_MS_Bold.ttf
chrome    22949 dev  79r      REG                8,6    136032  3670125 /usr/share/fonts/truetype/msttcorefonts/Verdana_Bold.ttf
chrome    22949 dev  80u      REG               0,22   4198400       27 /run/shm/.com.google.Chrome.reBCyQ (deleted)
chrome    22949 dev  81r      REG                8,6    123828  3670122 /usr/share/fonts/truetype/msttcorefonts/Trebuchet_MS_Bold.ttf
chrome    22949 dev  86u      REG               0,22   4198400      172 /run/shm/.com.google.Chrome.opHb4S (deleted)
chrome    22949 dev  87r      REG                8,6    330412  3670117 /usr/share/fonts/truetype/msttcorefonts/Times_New_Roman.ttf
chrome    22949 dev  90r      REG                8,6    330412  3670117 /usr/share/fonts/truetype/msttcorefonts/Times_New_Roman.ttf
chrome    22949 dev 104u      REG               0,22   4198400      193 /run/shm/.com.google.Chrome.Y05n64 (deleted)

6) How to list all open files by a process using PID
As I told, I mostly use lsof command to find all files opened by a particular process. In order to do that sometimes, I usually use grep command to filter lsof output by PID, but you can also use lsof -p option to do the same, as shown below :

$ lsof -p 17783

will list all files opened by the process with PID 17783.

List users and processes, you can also supply multiple PIDs to find files opened by multiple processes e.g. :

$ lsof -p 17783,17754,17984


7) How to list all network connection
You can use lsof - i option to find all open network connections which is nothing but open internet sockets (TCP and UDP), for example

Syntax: $ lsof -i

you can further find all TPC connection by using tcp option as shown below :

$ lsof -i tcp

Similarly, to find all open udp connections you can do :

$ lsof -i udp

will list all process with open internet sockets.



8) How to find which process is using a port
Though you can do this with netstat command as well, you would be surprised to know that you can find all process using a particular TCP or UDP port using lsof command.

Syntax: lsof -i :portnumber

Example:

root@linuxforfreshers.com:~# lsof -i :3306
COMMAND  PID  USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
mysqld  2149 mysql   10u  IPv4  12927      0t0  TCP localhost:mysql (LISTEN)


9) To list all open files on device /dev/sda, use:

     Syantax:    lsof /dev/sda

10) To find any open file, including an open UNIX domain socket file, with the name /dev/log, use:

    Syntax:        lsof /dev/log

11)  To find an IP version 4 socket file by its associated numeric dot-form address, use:

 Syntax: lsof -i@ipaddress

Example: lsof -i@192.168.101.1







No comments:

Post a Comment