lsof

هذا الجزء لم يُترجم بعد. أنت ترى النص الإنجليزي.

ماذا يفعل

On Linux "everything is a file", so lsof sees a lot: normal files, folders, libraries, devices, pipes and network connections. Admins use it to find who keeps a mount busy, which program listens on a port, why disk space is not freed after deleting a big log (+L1), or which files a suspicious process has open.

Selections are joined with OR by default; add -a to join them with AND (lsof -a -u apache -i). Run it as root to see the files of all users.

طريقة الكتابة

lsof [OPTION]... [--] [FILE]...

الخيارات 33

الأكثر استخدامًا

Select what to show

-i [ADDR]: Network files; ADDR like :22, TCP:443, @10.0.0.5, 4, 6.
-p PID[,PID]: Files of these processes (^PID excludes).
-u USER[,USER]: Files of these users (^USER excludes).
-c NAME: Processes whose command starts with NAME (/regex/ also works).
-g PGID: Processes of these process groups.
+d DIR: Open files directly in this folder.
+D DIR: Open files in this folder and all sub-folders.
+f -- PATH / -f: Treat PATH as a file system (all open files on it) / as a plain file.
+L1: Files with a link count below 1: deleted but still open.
-d FD: Only these file descriptors (cwd, txt, mem, 0-2).
-N: NFS files.
-U: UNIX domain sockets.
-s PROTO:STATE: Filter network files by state, for example -s TCP:LISTEN.
-a: Join all selections with AND.
-K: Also list threads (tasks).

Output

-n: Do not turn addresses into host names (faster).
-P: Do not turn port numbers into names.
-l: Show user IDs, not names.
-t: Print only PIDs (for kill $(lsof -t …)).
-R: Show the parent PID.
-o / -s: Always show the file offset / the file size.
-F FIELDS: Output for programs (one field per line).
-Z: Show the SELinux context.
+c W: Width of the command name column.
-V: Say which search items were not found.
-Q: Ignore failed search terms in the exit status.

Speed and safety

-b: Avoid kernel calls that may block.
-S [SEC]: Time-out for blocking kernel calls.
-O: Do not use the protection against blocking.
-C: Do not report path names from the kernel name cache.
-x [fl]: With +d/+D: also cross into other file systems and links.
-T [opts]: Control TCP/TPI details in the output.
-h, -? / -v: Help / version.

أمثلة 11

$ مستخدم عادي# بصلاحية root (أو مع sudo)

1Who keeps a mount busy?

#lsof +f -- /mnt/usb
COMMAND  PID    USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
bash    4321 student  cwd    DIR    8,1     4096    1 /mnt/usb
less    4402 student    4r   REG    8,1    10240   12 /mnt/usb/report.txt

2Which program listens on a port?

#lsof -nP -iTCP:443 -sTCP:LISTEN
COMMAND  PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
httpd   1420 root    6u  IPv6  23511      0t0  TCP *:443 (LISTEN)

3All network connections of one user
```
#lsof -a -nP -u apache -i
```
4Disk full, but du shows less? Find deleted files that are still open
```
#lsof -nP +L1
COMMAND  PID USER   FD   TYPE DEVICE   SIZE/OFF NLINK NODE NAME
java    2210 app     7w   REG  253,0 8589934592     0 1312 /var/log/app/app.log (deleted)
```
8 GiB still used by PID 2210. Restart the app (or truncate via /proc/2210/fd/7) to free the space.

5Files of one process

#lsof -p 1420 | head
#lsof -p 1420 -d txt,mem

6Who has a file open?
```
#lsof /var/log/messages
```
7All open files under a folder tree
```
#lsof +D /srv/app
```
8Kill everything that uses a folder
```
#kill $(lsof -t +D /srv/old)
```

9Established connections to a database server

#lsof -nP -iTCP@192.168.122.30:5432 -sTCP:ESTABLISHED

10Look at a suspicious process (DevSecOps / forensics)
```
#lsof -nP -p 6666
#ls -l /proc/6666/exe
```
Look for network connections to unknown hosts and for files in /tmp or /dev/shm.
11UNIX sockets of a service
```
#lsof -U -c sshd
```

انتبه

Without root you see only your own processes' files.
lsof can be slow on systems with NFS mounts that do not answer; use -b or -S 5.
lsof +D reads the whole tree — slow on big folders.

نصائح للحفظ

-nP makes every network listing much faster.
For only ports, ss -tlpn is faster; use lsof when you also need files.

رموز الخروج

`0`	Something was found and listed.
`1`	Nothing was found, or an error.

`lsof`

ماذا يفعل

طريقة الكتابة

الخيارات 33

Select what to show

Output

Speed and safety

أمثلة 11

1Who keeps a mount busy?

2Which program listens on a port?

3All network connections of one user

4Disk full, but du shows less? Find deleted files that are still open

5Files of one process

6Who has a file open?

7All open files under a folder tree

8Kill everything that uses a folder

9Established connections to a database server

10Look at a suspicious process (DevSecOps / forensics)

11UNIX sockets of a service

انتبه

نصائح للحفظ

رموز الخروج

الدليل الكامل

ماذا يفعل

طريقة الكتابة

الخيارات 33

Select what to show

Output

Speed and safety

أمثلة 11

1Who keeps a mount busy?

2Which program listens on a port?

3All network connections of one user

4Disk full, but du shows less? Find deleted files that are still open

5Files of one process

6Who has a file open?

7All open files under a folder tree

8Kill everything that uses a folder

9Established connections to a database server

10Look at a suspicious process (DevSecOps / forensics)

11UNIX sockets of a service

انتبه

نصائح للحفظ

رموز الخروج

أوامر مرتبطة

مُستخدم في هذه الدروس

مُستخدم في هذه المعامل

الدليل الكامل

`lsof`