Questions tagged [lsof]
Lsof is a tool to list opened files by processes
104
questions
39
votes
5
answers
32k
views
lsof - restrict output to physical files only - how?
How do I tell lsof I need to list only physical files (not sockets, not TCP/IP connections, only physical files)?
- 2,691
25
votes
2
answers
19k
views
How to track all files a process opens in its lifetime
I am aware of using lsof for checking the files currently accessed by a process. Does there exist a way to see all files that an application opens in its lifetime?
- 1,679
18
votes
1
answer
10k
views
What's the difference between `lsof -p <pid> | wc -l` and `ls /proc/<pid>/fd | wc -l`?
Background: I'm playing around with monitoring the ulimit for running processes for a particular user. (I had occasionally seen processes that were getting started with an incorrect limit.) I asked a ...
- 283
16
votes
4
answers
19k
views
How can lsof report a higher number of open files than what ulimit says should be allowed?
How can lsof report more open files than what ulimit says is the limit?
prod_web3(i-ca0b05aa):~$ sudo lsof | wc -l
4399
prod_web3(i-ca0b05aa):~$ ulimit -n
1024
- 1,677
14
votes
3
answers
4k
views
Link to a specific inode
I have a file that was deleted, but is still held open by a program. I found the inode number using lsof. How can I create a hard link back to that inode?
- 20.6k
13
votes
5
answers
961
views
How to make my boss understand that a server fault is a bad thing?
I'm currently working in Tokyo for a smaller company that has just started serious online business.
Recently we have been hitting the maximum open files issue on a rented VPS server causing services ...
- 247
13
votes
3
answers
2k
views
On Linux, how can I see how far through a file a process is?
If I have a piped command such as
cat myfile | processor_application
where processor_application is something reading from standard in, in chunks, to process, is it possible to see how far ...
- 590
13
votes
3
answers
34k
views
How to track down a file descriptor leak?
I have a java process (Glassfish) which is leaking file descriptors. I know this because I get the helpful java.io.IOException: Too many open files exception. I can look in /proc/PID#/fd and see all ...
- 567
13
votes
4
answers
8k
views
TCP monitoring on a server: comparing netstat vs lsof?
I'm monitoring the TCP stack on a server hoping to generically infer problems with application on the box.
My first inclination is to measure the number of sockets in all reported states (LISTEN,...
- 1,572
12
votes
2
answers
3k
views
non-cpu-intensive alternative to lsof?
We run an Apache Cassandra cluster where each host has a few hundred thousand files open at any given time.
We'd like to be able to get a count of open files at periodic intervals and feed this ...
- 2,665
10
votes
1
answer
15k
views
How can I observe what nginx is doing? (to solve: "1024 worker_connections are not enough")
I have a very low traffic site running on nginx, with 4 workers, 1024 connections each.
Every several hours I start seeing in the error log "1024 worker_connections are not enough", and my site slows ...
- 2,364
9
votes
3
answers
18k
views
Getting PID from lsof list
I have a react-native application and I want to write a script for start test version. I need to shotdown the :8081 port if it is alive. The command:
lsof -i :8081
kill -9 <PID>
The lsof ...
- 345
9
votes
4
answers
42k
views
Running lsof -i shows a lot of connections in CLOSE_WAIT ? Should I worry
So I am running lsof -i | wc -l periodically and it is telling me that out of 420 lines, between 240 and 255 are in CLOSE_WAIT state. How does TCP connections enter this state?
Should I be worried ...
- 193
8
votes
3
answers
14k
views
lsof runs very slow in my server
I'm running lsof in one of my Linux server to check if one file (/tmp/incoming_data.txt) in the ext3 system is opened by other programs. My server has lots of TCP connection on it. The weird thing is ...
- 396
6
votes
4
answers
13k
views
Log network traffic with process ID on Mac OS X?
I want to log all network traffic on a Mac OS X server (like tcpdump does), but including the ID of the process that is responsible. Using lsof only gives me the current connections, not the past ones....
- 191
6
votes
1
answer
15k
views
unmounted logical volume is "busy"?
I'm trying to shrink an ext4 filesystem on a CentOS 6 server. I did a lazy unmount of the filesystem while I waited for some processes to finish running. They've all finished running but I can't ...
- 1,867
5
votes
3
answers
18k
views
lsof for files opened by other users
How do I see the list of files open (lsof) in a specific directory and by other users?
I can do lsof +D /path, but that only shows current user's files.
Any way to see if other users have opened ...
Ash
5
votes
1
answer
863
views
How can I list all accessed files on process startup
I have a process that fails on startup due to some permission issues. I want to check what files it tries to open on startup but with lsof I can list only opened files for a running process but what ...
- 355
5
votes
1
answer
1k
views
Why is rpc.lockd obscured from netstat/lsof output?
Prologue:
On a number of machines, which happen to act as NFS clients, netstat reports two ports that are open with no PID listed for an associated daemon. Ordinarily this might be a bit concerning.
...
- 25.7k
5
votes
3
answers
5k
views
How to find full process arguments and associated listening ports?
I can execute netstat -atulpn | grep java to find all Java processes with their accompanying ports, which is great, however I would like to also have the processes full execution arguments also shown. ...
- 1,197
4
votes
2
answers
7k
views
how to list files that are NOT open using find command
I want to "list" all the files that are NOT open, within a certain directory using the GNU find command. Now, I am able to list the files that are open, but can't figure out a way to do the inverse of ...
- 143
4
votes
1
answer
4k
views
In lsof output what are those 'sock' lines?
In lsof command under Ubuntu/Debian, I'm seeing a lot of lines like below:
PROGRAM 829 root 140u sock 0,8 0t0 244182 protocol: TCP
What are these lines?
Can they be results of ...
- 191
4
votes
1
answer
2k
views
Near 100% disk usage, df and du show very different results, lsof not the answer
The issue is that my CentOS 5.8 machine is telling me that I am nearly out of disk space when I am pretty confident this is not the case. I've done a fair amount of researching on this issue and have ...
- 49
3
votes
2
answers
13k
views
How to determine which TCP/UDP ports are being opened by a given process (linux)?
I know how to do the opposite (find out what process has a given port open) using lsof or netstat, but extensive research on Google hasn't helped me solve the reverse problem.
I know I could use "...
- 386
3
votes
1
answer
1k
views
lsof runs REALLY slow when Chromium or Firefox is open
I have a little script that runs lsof on my laptop (Ubuntu Natty) every now and then to check for a few things. I recently noticed that it runs really slowly when I have Chromium or Firefox open.
...
- 189
3
votes
1
answer
4k
views
Custom lsof output
The following command produced the unix domain socket opened by PID 30661
$ sudo lsof -U -a -p 30661
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
haproxy 30661 haproxy 7u ...
- 2,788
3
votes
2
answers
1k
views
trace opening on a certain file
I know how to strace a certain program to see all the files it reads. I know how to see what processes are using a certain file at the moment.
But is there a way to log all file opens. I want ...
3
votes
2
answers
6k
views
How to find the other point of a Unix domain socket on Mac OS X to write/read it?
I listed open file for a process (a daemon) on my box which runs Mac OS X 10.5 :
>lsof -p 89
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
...
xxxxx 89 xxxxxxxx 9u unix ...
- 268
3
votes
3
answers
3k
views
lsof doesn't show the established TCP connection
On my system, if I run the netstat for a port, it returns:
$ netstat -nat | grep "60964"
tcp 0 0 192.0.0.1:60964 0.0.0.0:* LISTEN
tcp 59 0 192.0.0....
- 155
2
votes
2
answers
1k
views
How to map an ephemeral port to a pid?
I have a RHEL server with several apps on it and I am attempting to figure out which one of them is making calls to an external web service. I have TCP dumps that show the calls being made and through ...
- 3,855
2
votes
1
answer
6k
views
Safe to kill a process called *:etlservicemgr (LISTEN)?
I am trying to serve locally to port 9001 but I get an listen EADDRINUSE error. When I look at the port with lsof -i :9001 it shows the following
COMMAND PID USER FD TYPE DEVICE ...
- 21
2
votes
2
answers
405
views
how can i see if an open filehandle is writeable or not on a linux system?
I can see with lsof that a process has an open filehandle for a particular file, but is there a way that I can see what kind of filehandle (ex: r, rw) it is?
- 121
2
votes
1
answer
3k
views
What does the lsof -c flag filter out?
lsof will show a table with the first column being the command name and each row, an open file. So to only show rows from a specific command, say "java", it would make sense to try lsof | grep ^java. ...
- 121
2
votes
1
answer
584
views
nrpe user cant properly execute script remotely using lsof, netstat works
I created a simple script for nagios to check a port on a remote server. Originally, I tried to use lsof.
#!/bin/bash
RESULT=$(lsof -i :8080 | grep LISTEN)
if [ -n "$RESULT" ]
then
echo "$...
- 639
2
votes
3
answers
4k
views
Unexplicated ssh connection from localhost through sshd to random localhost's port
I've tried to find out why I had some strange connections on my secure log file. Something like this :
Apr 23 11:35:43 li192-61 sshd[11651]: Did not receive identification string from 127.0.0.1
Apr ...
- 25
2
votes
4
answers
560
views
How to find the program responsible for a specific TCP socket (linux)
joe@server:~$ sudo lsof -i :36168
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
java 23059 activemq 15u IPv6 109382 0t0 TCP *:36168 (LISTEN)
From the output above I want to ...
- 171
2
votes
1
answer
4k
views
lsof shows tmp growing file marked as deleted
I have a cron that generated a lot (15GB) of PHP warnings and was writing them in a log file.
I killed the process and as a temporary measure I stopped redirecting stderr to stdout so I don't fill up ...
- 155
2
votes
5
answers
21k
views
"Logical volume in use" -- cannot remove logical volume
On a Xen 4.8 hypervisor, running on Debian Stretch, I am trying to remove the logical volume of a domU that is no longer used.
I stopped the domU and successfully removed the logical volume for the ...
- 121
2
votes
1
answer
7k
views
Linux : Count Open Files for Process
How can I check how many open files are currently used?
Checking on PM2 is just an example:
I found the PID:
ps aux | grep pm2 | awk '{ print $2 }'
Checked that there is a limit of 65536 ...
- 123
2
votes
1
answer
208
views
lsof returns "can't read vnode" error
On a Solaris 10 box, I am getting errors from lsof:
can't read vnode at 0x7d900000000
can't read vnode at 0x7b
But I have the same lsof binary in another similar Solaris 10 box where it doesn't give ...
- 468
2
votes
1
answer
438
views
Regular and repetitive sudo alerts from several Linux hosts
I've got several hosts running CentOS 5.11 on the LAN. Lately we've been getting fairly regular sudo alerts (via email) from attempted sudo commands by non-authorized users. Been Googling in case the ...
- 61
2
votes
1
answer
2k
views
txt file descriptor in lsof
In my experience, files that have the file descriptor of txt in lsof output are the executable file itself and shared objects. The lsof man page says that it means "program text (code and data)".
...
- 6,938
2
votes
2
answers
5k
views
tracking down what files are causing io activity in iostat
Using
iostat -Nkx 1
I can see that I am getting regular IO on a volume group. What I'm trying to do is find a way to link that IO to a file/pipe/whatever to see what process is creating this IO and ...
- 553
2
votes
1
answer
2k
views
cant counting all open files by lsof + lsof is hung
we are tying to count all open files by lsof
lsof | wc -l
lsof: WARNING: can't stat() fuse.gvfsd-fuse file system /run/user/42/gvfs
Output information may be incomplete.
but sill after 1 hour ...
- 471
2
votes
1
answer
79
views
Is it possible to deterministically trace how port 80 is forwarded and where the configuration is on a given system?
Is there a way to determine or trace how a port forwarding configuration is set up on a system running Ubuntu 14.04 LTS, on which there is a NodeJS service running and somehow accepting connections ...
- 163
2
votes
2
answers
1k
views
find owner and spawn process of ssh connection
There is this one server I manage which regularly (few times a minute) tries a connection to another machine on tcp port 22. (ssh)
My question: how can I find the process that spawned this connection?...
- 91
2
votes
1
answer
2k
views
Tracking down an elusive and slow anon_inode from lsof and Apache strace
Experiencing an intermittent issue with a LAMP application wherein Apache forks to its ServerLimit and grinds to a (near) halt. An strace on any httpd process shows numerous, slow epoll_wait calls.
1....
2
votes
1
answer
589
views
Process has more open sockets than should be allowed by prlimit
Running debian jessie. The following is done as root to avoid any permissions issues.
First I find the pid of my program, then I check its open file limit to verify that it is set at 1024. But when I ...
- 236
2
votes
1
answer
1k
views
Incoming FTP transfer not showing in lsof when using specific FTP client
I've got a script that continuously monitors an FTP dropbox directory and processes new files when they come in. The script runs lsof on each file before it tries to process it to determine if the ...
- 41
2
votes
0
answers
1k
views
Apache web server maxing out due to processes stuck at D status
I have a Apache 2.2.3 web server running on a 8 core VM with 8G Ram.
During a load test, the web server stopped responding and load average went up to 1000.
When I run Top command, I see a large ...
- 121