lsof 的查看打开的文件--list open files

http://www.ibm.com/developerworks/aix/library/au-lsof.html

http://www.lifelinux.com/10-lsof-command-examples/

例子：

bash-3.00# lsof
命令        进程号  用户                                       设备        大小            inode     文件名
COMMAND    PID   USER   FD   TYPE        DEVICE SIZE/OFF      NODE NAME
sched              0         root     cwd   VDIR         136,8     1024               2          /
init                   1          root     cwd   VDIR         136,8     1024              2          /
init                   1          root      txt     VREG         136,8    49016        1655     /sbin/init
init                   1          root      txt     VREG         136,8    51084        3185     /lib/libuutil.so.1
vi                 2013       root      3u    VREG          136,8        0            8501      /var/tmp/ExXDaO7d

The FD column represents the file descriptor, which is how the application sees the file.
       cwd 表示目录
       txt   表示可执行代码
       3u   3表示fd的号，u表示可读写状态

The Type column gives more description about what form the file takes.
      REG and DIR CHR and BLK
     UNIX, FIFO , and IPv4 for UNIX domain sockets, first-in-first-out (FIFO) queues, and Internet Protocol (IP) sockets.


显示指定的某个pid进程打开的文件

-a 表示后面的条件为同事满足， -p制定进程id，-d 用来指定文件的类型，
sh-3.00# lsof -a -p 605 -d ^txt
COMMAND  PID USER   FD   TYPE  DEVICE SIZE/OFF     NODE NAME
sendmail 605 root  cwd   VDIR  136,8     1024    23554 /var/spool/mqueue
sendmail 605 root    0r  VCHR  13,2            6815752 /devices/pseudo/mm@0:null
sendmail 605 root    1w  VCHR  13,2            6815752 /devices/pseudo/mm@0:null
sendmail 605 root    2w  VCHR  13,2            6815752 /devices/pseudo/mm@0:null
sendmail 605 root    3r  DOOR             0t0       58
        /var/run/name_service_door(door to nscd[81]) (FA:->0x30002b156c0)
sendmail 605 root    4w  VCHR  21,0           11010052
                        /devices/pseudo/log@0:conslog->LOG
sendmail 605 root    5u  IPv4 0x300010ea640      0t0      TCP *:smtp (LISTEN)
sendmail 605 root    6u  IPv6 0x3000431c180      0t0      TCP *:smtp (LISTEN)
sendmail 605 root    7u  IPv4 0x300046d39c0      0t0      TCP *:submission (LISTEN)
sendmail 605 root    8wW VREG         281,3       32  8778600 /var/run/sendmail.pid


显示谁使用了某个文件
使用-D进行递归
bash-3.00# lsof /var/run/sendmail.pid
COMMAND  PID USER   FD   TYPE DEVICE SIZE/OFF    NODE NAME
sendmail 605 root    8wW VREG  281,3       32 8778600 /var/run/sendmail.pid

这个也可以用fuser来查

$/sbin/fuser -v  .nfs00c3f4690000107a

                     USER        PID ACCESS COMMAND
.nfs00c3f4690000107a wyang2      834 f....  cscope

显示谁在用端口25
# lsof -i :25
COMMAND  PID USER   FD   TYPE        DEVICE SIZE/OFF NODE NAME
sendmail 605 root    5u  IPv4 0x300010ea640      0t0  TCP *:smtp (LISTEN)
sendmail 605 root    6u  IPv6 0x3000431c180      0t0  TCP *:smtp (LISTEN)

The lsof utility expects that you will pass it something in the form of protocol:@ip:port,
where the protocol is TCP or UDP (and optionally prefixed by 4 or 6 to refer to the version of IP),
the IP is a resolvable name or IP address, and the port is a number or name (out of /etc/services) representing the service.

显示active的连接
# lsof -i @192.168.1.10
COMMAND  PID USER   FD   TYPE        DEVICE  SIZE/OFF NODE NAME
sshd    1934 root    6u  IPv6 0x300046d21c0 0t1303608  TCP sun:ssh->linux:40379
                             (ESTABLISHED)
sshd    1937 root    4u  IPv6 0x300046d21c0 0t1303608  TCP sun:ssh->linux:40379
                             (ESTABLISHED)