Lsof - List Open Files

lsof is short for LiSt Open Files; it displays, in list form, which process has a given file open — files include disk files, network sockets, pipes, and devices. One of the main situations for using this command is when you can’t unmount a disk and it shows an error saying some file is in use or open. With this command, you can easily see which file is being used. [1]

Syntax

lsof[-?abhlnNoOPRtUvVX] [+|-c c] [+|-d s] [+D D] [+|-f[gG]] [+|-e s] [-F [f]] [-g [s]] [-i [i]]
[+|-L [l]] [+m [m]] [+|-M] [-o [o]] [-p s] [+|-r [t]] [-s [p:s]] [-S [t]] [-T [t]] [-u s] [+|-w] [-x [fl]] [--] [names]

Examples

List all open files

lsof

COMMAND    PID      USER   FD (文件描述符)        TYPE（文件类型）     DEVICE  SIZE/OFF       NODE NAME
init         1      root  cwd (当前工作目录)      DIR （目录）         253,0      4096          2 /
init         1      root  rtd (root目录)          DIR （目录）         253,0      4096          2 /
init         1      root  txt (程序代码和数据）   REG （普通文件）     253,0    145180     147164 /sbin/init
init         1      root  mem (内存映射文件)      REG （普通文件）     253,0   1889704     190149 /lib/libc-2.12.so
nginx     23780     nginx  0u（读写访问）         CHR （特殊字符文件） 1,3         0t0  188451717 /dev/null
rsyslogd   3856     root   1r（读访问）           REG （普通文件）     144,8         0 4026545856 /proc/kmsg
mysqld    32336     mysql  2w（写访问）           FIFO（先入先出）     0,6         0t0  126330358 pipe

List files opened by a given process

lsof -p 23780

COMMAND   PID  USER   FD   TYPE             DEVICE SIZE/OFF      NODE NAME
nginx   23780 nginx  cwd    DIR              144,7     4096 188448964 /
nginx   23780 nginx  rtd    DIR              144,7     4096 188448964 /
nginx   23780 nginx  txt    REG              144,7   825320 188454748 /usr/sbin/nginx
nginx   23780 nginx  mem    REG                8,5          188454748 /usr/sbin/nginx (path dev=144,7)

List files opened by a given user

lsof -u nginx

COMMAND   PID  USER   FD   TYPE             DEVICE SIZE/OFF      NODE NAME
nginx   23780 nginx  cwd    DIR              144,7     4096 188448964 /
nginx   23780 nginx  rtd    DIR              144,7     4096 188448964 /
nginx   23780 nginx  txt    REG              144,7   825320 188454748 /usr/sbin/nginx
nginx   23780 nginx  mem    REG                8,5          188454748 /usr/sbin/nginx (path dev=144,7)

List all network connections

lsof -i

List only IPv4 network connections

lsof -i 4

List only TCP connections

lsof -i TCP

List network connections currently listening

lsof -i -s TCP:LISTEN

List established network connections

lsof -i -s TCP:ESTABLISHED

List processes running on a given port

lsof -i TCP:80

COMMAND   PID  USER   FD   TYPE    DEVICE SIZE/OFF NODE NAME
nginx   23780 nginx    3u  IPv4 338498973      0t0  TCP lfzyx.org:http->58.137.148.210:57582 (ESTABLISHED)
nginx   23780 nginx    6u  IPv4    250008      0t0  TCP *:http (LISTEN)
nginx   23780 nginx   19u  IPv4 338498376      0t0  TCP lfzyx.org:http->150-70-75-34.trendmicro.com:54366 (ESTABLISHED)
nginx   23780 nginx   22u  IPv4 338498234      0t0  TCP lfzyx.org:http->wf-171-99-47-76.revip9.asianet.co.th:18447 (ESTABLISHED)
nginx   32446  root    6u  IPv4    250008      0t0  TCP *:http (LISTEN)

List processes running on a given port range

lsof -i TCP:1-1024

COMMAND   PID   USER   FD   TYPE    DEVICE SIZE/OFF NODE NAME
portmap  3759 daemon    5u  IPv4    249950      0t0  TCP *:sunrpc (LISTEN)
nginx   23780  nginx    3u  IPv4 338529365      0t0  TCP lfzyx.org:http->ppp-124-121-2-252.revip2.asianet.co.th:64427 (ESTABLISHED)
nginx   23780  nginx    6u  IPv4    250008      0t0  TCP *:http (LISTEN)
nginx   32446   root    6u  IPv4    250008      0t0  TCP *:http (LISTEN)

List connections to a given host

lsof -i @10.10.10.118[:8080]

List files opened by users other than root

lsof -u ^root

参考文献