lsof

Dit deel is nog niet vertaald. Je ziet de Engelse tekst.

Wat het doet

On Linux "everything is a file", so lsof sees a lot: normal files, folders, libraries, devices, pipes and network connections. Admins use it to find who keeps a mount busy, which program listens on a port, why disk space is not freed after deleting a big log (+L1), or which files a suspicious process has open.

Selections are joined with OR by default; add -a to join them with AND (lsof -a -u apache -i). Run it as root to see the files of all users.

Zo schrijf je het

lsof [OPTION]... [--] [FILE]...

Opties 33

Meest gebruikt

Select what to show

-i [ADDR]: Network files; ADDR like :22, TCP:443, @10.0.0.5, 4, 6.
-p PID[,PID]: Files of these processes (^PID excludes).
-u USER[,USER]: Files of these users (^USER excludes).
-c NAME: Processes whose command starts with NAME (/regex/ also works).
-g PGID: Processes of these process groups.
+d DIR: Open files directly in this folder.
+D DIR: Open files in this folder and all sub-folders.
+f -- PATH / -f: Treat PATH as a file system (all open files on it) / as a plain file.
+L1: Files with a link count below 1: deleted but still open.
-d FD: Only these file descriptors (cwd, txt, mem, 0-2).
-N: NFS files.
-U: UNIX domain sockets.
-s PROTO:STATE: Filter network files by state, for example -s TCP:LISTEN.
-a: Join all selections with AND.
-K: Also list threads (tasks).

Output

-n: Do not turn addresses into host names (faster).
-P: Do not turn port numbers into names.
-l: Show user IDs, not names.
-t: Print only PIDs (for kill $(lsof -t …)).
-R: Show the parent PID.
-o / -s: Always show the file offset / the file size.
-F FIELDS: Output for programs (one field per line).
-Z: Show the SELinux context.
+c W: Width of the command name column.
-V: Say which search items were not found.
-Q: Ignore failed search terms in the exit status.

Speed and safety

-b: Avoid kernel calls that may block.
-S [SEC]: Time-out for blocking kernel calls.
-O: Do not use the protection against blocking.
-C: Do not report path names from the kernel name cache.
-x [fl]: With +d/+D: also cross into other file systems and links.
-T [opts]: Control TCP/TPI details in the output.
-h, -? / -v: Help / version.

Voorbeelden 11

$ als gewone gebruiker# als root (of met sudo)

1Who keeps a mount busy?

#lsof +f -- /mnt/usb
COMMAND  PID    USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
bash    4321 student  cwd    DIR    8,1     4096    1 /mnt/usb
less    4402 student    4r   REG    8,1    10240   12 /mnt/usb/report.txt

2Which program listens on a port?

#lsof -nP -iTCP:443 -sTCP:LISTEN
COMMAND  PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
httpd   1420 root    6u  IPv6  23511      0t0  TCP *:443 (LISTEN)

3All network connections of one user
```
#lsof -a -nP -u apache -i
```
4Disk full, but du shows less? Find deleted files that are still open
```
#lsof -nP +L1
COMMAND  PID USER   FD   TYPE DEVICE   SIZE/OFF NLINK NODE NAME
java    2210 app     7w   REG  253,0 8589934592     0 1312 /var/log/app/app.log (deleted)
```
8 GiB still used by PID 2210. Restart the app (or truncate via /proc/2210/fd/7) to free the space.

5Files of one process

#lsof -p 1420 | head
#lsof -p 1420 -d txt,mem

6Who has a file open?
```
#lsof /var/log/messages
```
7All open files under a folder tree
```
#lsof +D /srv/app
```
8Kill everything that uses a folder
```
#kill $(lsof -t +D /srv/old)
```

9Established connections to a database server

#lsof -nP -iTCP@192.168.122.30:5432 -sTCP:ESTABLISHED

10Look at a suspicious process (DevSecOps / forensics)
```
#lsof -nP -p 6666
#ls -l /proc/6666/exe
```
Look for network connections to unknown hosts and for files in /tmp or /dev/shm.
11UNIX sockets of a service
```
#lsof -U -c sshd
```

Let op

Without root you see only your own processes' files.
lsof can be slow on systems with NFS mounts that do not answer; use -b or -S 5.
lsof +D reads the whole tree — slow on big folders.

Tips om te onthouden

-nP makes every network listing much faster.
For only ports, ss -tlpn is faster; use lsof when you also need files.

Exitcodes

`0`	Something was found and listed.
`1`	Nothing was found, or an error.

`lsof`

Wat het doet

Zo schrijf je het

Opties 33

Select what to show

Output

Speed and safety

Voorbeelden 11

1Who keeps a mount busy?

2Which program listens on a port?

3All network connections of one user

4Disk full, but du shows less? Find deleted files that are still open

5Files of one process

6Who has a file open?

7All open files under a folder tree

8Kill everything that uses a folder

9Established connections to a database server

10Look at a suspicious process (DevSecOps / forensics)

11UNIX sockets of a service

Let op

Tips om te onthouden

Exitcodes

Volledige handleiding

Wat het doet

Zo schrijf je het

Opties 33

Select what to show

Output

Speed and safety

Voorbeelden 11

1Who keeps a mount busy?

2Which program listens on a port?

3All network connections of one user

4Disk full, but du shows less? Find deleted files that are still open

5Files of one process

6Who has a file open?

7All open files under a folder tree

8Kill everything that uses a folder

9Established connections to a database server

10Look at a suspicious process (DevSecOps / forensics)

11UNIX sockets of a service

Let op

Tips om te onthouden

Exitcodes

Verwante commando's

Gebruikt in deze lessen

Gebruikt in deze labs

Volledige handleiding

`lsof`