Node 0 MemTotal: 23939536 kB Node 0 MemFree: 16603236 kB Node 0 MemUsed: 7336300 kB Node 0 Active: 2776768 kB Node 0 Inactive: 1518064 kB Node 0 Active(anon): 547784 kB Node 0 Inactive(anon): 159716 kB Node 0 Active(file): 2228984 kB Node 0 Inactive(file): 1358348 kB Node 0 Unevictable: 57644 kB Node 0 Mlocked: 57644 kB Node 0 Dirty: 184 kB Node 0 Writeback: 0 kB Node 0 FilePages: 3850256 kB Node 0 Mapped: 139772 kB Node 0 AnonPages: 502392 kB Node 0 Shmem: 259096 kB Node 0 KernelStack: 8176 kB Node 0 PageTables: 19276 kB Node 0 NFS_Unstable: 0 kB Node 0 Bounce: 0 kB Node 0 WritebackTmp: 0 kB Node 0 Slab: 238604 kB Node 0 SReclaimable: 203884 kB Node 0 SUnreclaim: 34720 kB Node 0 AnonHugePages: 215040 kB Node 0 HugePages_Total: 1176 Node 0 HugePages_Free: 0 Node 0 HugePages_Surp: 0 # lz eJ~qTţ e>? A Quick Start for Lsof 1. Introduction ================ Agreed, the lsof man page is dense and lsof has a plethora of options. There are examples, but the manual page format buries them at the end. How does one get started with lsof? This file is an attempt to answer that question. It plunges immediately into examples of lsof use to solve problems that involve looking at the open files of Unix processes. Contents 1. Introduction 2. Finding Uses of a Specific Open File 3. Finding Open Files Filling a File System a. Finding an Unlinked Open File 4. Finding Processes Blocking Umount 5. Finding Listening Sockets 6. Finding a Particular Network Connection 7. Identifying a Netstat Connection 8. Finding Files Open to a Named Command 9. Deciphering the Remote Login Trail a. The Fundamentals b. The idrlogin.perl[5] Scripts 10. Watching an Ftp or Rcp Transfer 11. Listing Open NFS Files 12. Listing Files Open by a Specific Login a. Ignoring a Specific Login 13. Listing Files Open to a Specific Process Group 14. When Lsof Seems to Hang a. Kernel lstat(), readlink(), and stat() Blockages b. Problems with /dev or /devices c. Host and Service Name Lookup Hangs d. UID to Login Name Conversion Delays 15. Output for Other Programs 16. The Lsof Exit Code and Shell Scripts 17. Strange messages in the NAME column Options A. Selection Options B. Output Options C. Precautionary Options D. Miscellaneous Lsof Options 2. Finding Uses of a Specific Open File ======================================== Often you're interested in knowing who is using a specific file. You know the path to it and you want lsof to tell you the processes that have open references to it. Simple -- execute lsof and give it the path name of the file of interest -- e.g., $ lsof /etc/passwd Caveat: this only works if lsof has permission to get the status (via stat(2)) of the file at the named path. Unless the lsof process has enough authority -- e.g., it is being run with a real User ID (UID) of root -- this AIX example won't work: Further caveat: this use of lsof will fail if the stat(2) kernel syscall returns different file parameters -- particularly device and inode numbers -- than lsof finds in kernel node structures. This condition is rare and is usually documented in the 00FAQ file of the lsof distribution. $ lsof /etc/security/passwd lsof: status error on /etc/security/passwd: Permission denied 3. Finding Open Files Filling a File System ============================================ Oh! Oh! /tmp is filling and ls doesn't show that any large files are being created. Can lsof help? Maybe. If there's a process that is writing to a file that has been unlinked, lsof may be able to discover the process for you. You ask it to list all open files on the file system where /tmp is located. Sometimes /tmp i