Lsof detailed

Lsof is a model of Unix philosophy, it only completes a function, and is quite perfect —— it can list all the file information opened by a certain process. Open files may be ordinary files, directories, NFS files, block files, character files, shared libraries, regular pipes, named pipes, symbolic links, Socket streams, network Sockets, UNIX domain Sockets, and many more. Because "all files are" is one of the important philosophies of the Unix system, so you can imagine the important position of the lsof command. Lsof [options] filename

lsof /path/to/somefile: displays a list of all processes that open the specified file. lsof -c string: displays all open files of the process containing the specified character (string) in its COMMAND column. This option can be reused to specify multiple modes; lsof -p PID: to see which files are opened by the process; the process number can be used before the character string <;^” inversion; lsof -u USERNAME: display the specified user The file opened by the process; the user name can be used before the user name "^” inversion, such as “lsof -u ^root” is used to display all files opened by non-root users; lsof -g GID: display the process of the home gid The situation lsof +d /DIR/: shows the file opened by the process in the specified directory lsof +D /DIR/: the basic function is the same as above, but lsof will recursively find the specified directory, note that this parameter is slower than the grep version: lsof -a : Combine multiple conditions with “ & rdquo; such as lsof -a -c apache -u apachelsof -N: list all NFS (network file system) files lsof -d FD: display the relevant process of the specified file descriptor; I think the descriptor specifies a range, such as 0-2 for 0, 1, 2 file descriptors; in addition, -d also supports many other special values, such as: mem: list all memory mapping files; mmap: display all memory Mapping device; txt: lists all processes loaded in memory and executing, including code and data; cwd: list of processes accessing the current directory;

lsof -n: does not reverse IP to HOSTNAMElsof - i: used to display the status of the eligible process lsof -i[46] [protocol][@hostname| Hostaddr][:service| Port]46: IPv4 or IPv6protocol: TCP or UDPhostname: Internet host namehostaddr: IPv4 address service: /etc/service service name (may be more than one) port: port number (may be more than one)

For example: Check the status of port 22 running now [root@www ~]# lsof -i :22COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAMEsshd 1390 root 3u IPv4 13050 0t0 TCP *:ssh (LISTEN)sshd 1390 root 4u IPv6 13056 0t0 TCP *:ssh (LISTEN)sshd 36454 root 3r IPv4 94352 0t0 TCP www.magedu.com:ssh->172.16.0.1:50018 (ESTABLISHED)

In the above command, each line displays an open file. If you do not specify a condition, all files opened by all processes will be displayed by default. The meaning of lsof output column information is as follows: COMMAND: process name PID: process identifier USER: process owner FD: file descriptor, the application identifies the file by file descriptor. Such as cwd, txt, etc. TYPE: file type, such as DIR, REG, etc. DEVICE: Specify the name of the disk SIZE: the size of the file NODE: the index node (the identifier of the file on the disk) NAME: the exact name of the open file