| Parameter |
Meaning |
| File(s) |
Show accesses to these files.
Example: Who is using vim?
$ lsof /usr/bin/vim
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
vim 495 jfranken txt REG 3,3 1102088 175460 /usr/bin/vim
vim 1919 jfranken txt REG 3,3 1102088 175460 /usr/bin/vim
|
|
| Device(s) or mountpoint(s) |
Show accesses to these device(s) or mountpoint(s).
Example: Who is accessing the CD drive?
$ lsof /dev/cdrom
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
bash 3050 jfranken cwd DIR 3,64 2048 53248 /cdrom
|
|
| +D Verzeichnis |
Show accesses to any files underneath this directory.
Example: Who is accessing files in the /tmp directory?
$ lsof +D /tmp/
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
xfs 398 root 3u unix 0xc2019400 993 /tmp/.font-unix/fs7100
XFree86 433 root 1u unix 0xc1da0da0 1111 /tmp/.X11-unix/X0
ssh-agent 477 jfranken 3u unix 0xc1da1aa0 1155 /tmp/ssh-XXWzoqlO/agent.452
|
|
| +p PIDs |
Show anything, what is opened by processes with these PIDs. If you want to specify several PIDs, separate them with
commas.
Example: What files is my shell using?
$ lsof +p 3050
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
bash 3050 jfranken cwd DIR 3,64 2048 53248 /cdrom
bash 3050 jfranken rtd DIR 3,3 4096 2 /
bash 3050 jfranken txt REG 3,3 511400 191483 /bin/bash
bash 3050 jfranken mem REG 3,3 90210 159620 /lib/ld-2.2.5.so
bash 3050 jfranken mem REG 3,3 248132 160128 /lib/libncurses.so.5.2
bash 3050 jfranken mem REG 3,3 8008 160201 /lib/libdl-2.2.5.so
bash 3050 jfranken mem REG 3,3 1153784 160196 /lib/libc-2.2.5.so
bash 3050 jfranken mem REG 3,3 40152 160223 /lib/libnss_compat-2.2.5.so
bash 3050 jfranken mem REG 3,3 69472 160205 /lib/libnsl-2.2.5.so
bash 3050 jfranken 0u CHR 136,3 5 /dev/pts/3
bash 3050 jfranken 1u CHR 136,3 5 /dev/pts/3
bash 3050 jfranken 2u CHR 136,3 5 /dev/pts/3
bash 3050 jfranken 255u CHR 136,3 5 /dev/pts/3
|
|
| -c name |
Show anything, what is opened by processes, whose name starts like this.
Example: What files are in use by the init process?
$ lsof -c init
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
init 1 root cwd DIR 3,3 4096 2 /
init 1 root rtd DIR 3,3 4096 2 /
init 1 root txt REG 3,3 27844 175778 /sbin/init
init 1 root mem REG 3,3 90210 159620 /lib/ld-2.2.5.so
init 1 root mem REG 3,3 1153784 160196 /lib/libc-2.2.5.so
init 1 root 10u FIFO 3,3 98956 /dev/initctl
|
|
| -u user[,user...] |
Show anything, what is opened by processes, whose user name matches one of the given names or user-IDs. If you want
to specify several users, separate them with commas. If you want to specify any users not matching a certain
name or ID, prepend a ^-character to it.
Example: What files are being accessed by real users?
$ lsof -u ^root
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
bash 5712 jfranken cwd DIR 3,3 4096 146941 /home/jfranken
bash 5712 jfranken rtd DIR 3,3 4096 2 /
bash 5712 jfranken txt REG 3,3 511400 191483 /bin/bash
bash 5712 jfranken mem REG 3,3 90210 159620 /lib/ld-2.2.5.so
bash 5712 jfranken mem REG 3,3 248132 160128 /lib/libncurses.so.5.2
bash 5712 jfranken mem REG 3,3 8008 160201 /lib/libdl-2.2.5.so
bash 5712 jfranken mem REG 3,3 1153784 160196 /lib/libc-2.2.5.so
bash 5712 jfranken mem REG 3,3 40152 160223 /lib/libnss_compat-2.2.5.so
bash 5712 jfranken mem REG 3,3 69472 160205 /lib/libnsl-2.2.5.so
[...]
|
|
| -i [TCP|UDP][@host][:ports] |
Show any network connections matching a given host or port. The host can be named by its hostname or IP address,
and the port by its number or service name. To specify more than one port, you can write them as a list (e.g.
ssh,www) or range (e.g. 1-1024).
Example: What processes are talking on port 80?
$ lsof -i :80
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
thttpd 569 root 0u IPv4 2886 TCP *:www (LISTEN)
opera 3834 jfranken 20u IPv4 86644 TCP localhost:1055->localhost:www (CLOSE_WAIT)
|
|
| +L 1 |
Deleted files, which are still opened.
Example: What open files were deleted?
$ lsof -a +L1 /
COMMAND PID USER FD TYPE DEVICE SIZE NLINK NODE NAME
cardmgr 280 root 1u CHR 254,0 0 112863 /var/lib/pcmcia/cm-280-0 (deleted)
cardmgr 280 root 2u CHR 254,1 0 112870 /var/lib/pcmcia/cm-280-1 (deleted)
|
|
big_brother.pl [5 kB] , a monitoring-script to detect and list new network
connections.