lsof 用来查看文件被进程使用的情况。文件的含义很宽泛,它也可以指一个端口。
这条命令的使用方法很灵活。
用法1) lsof xia 显示正在使用文件abc.file的进程
我用cat>xia后,执行lsof xia,得到如下结果。
root@patrick.ubuntu.com:/usr/local/home/patrick> lsof xia
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
cat 26594 patrick 1w VREG 85,40 0 799088 xia
用法2)lsof -c cat 显示command列中包含指定字符(即:cat)的进程所有打开的文件
root@patrick.ubuntu.com:/usr/local/home/patrick> lsof -c cat
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
cat 26594 patrick cwd VDIR 85,40 512 799091 /usr/local/home/patrick
cat 26594 patrick txt VREG 85,40 10260 6034 /usr/bin/cat
cat 26594 patrick txt VREG 85,10 1639036 453 /lib/libc.so.1
cat 26594 patrick txt VREG 85,40 24996 18765 /usr/lib/locale/en_US.ISO8859-1/en_US.ISO8859-1.so.3
cat 26594 patrick txt VREG 85,10 4940 171 /platform/sun4v/lib/libc_psr/libc_psr_hwcap1.so.1
cat 26594 patrick txt VREG 85,10 280840 422 /lib/ld.so.1
cat 26594 patrick 0u VCHR 24,49 0 /devices/pseudo/pts@0:49->ttcompat->ldterm->ptem->pts
cat 26594 patrick 1w VREG 85,40 0 799088 /usr/local/home/patrick/xia
cat 26594 patrick 2u VCHR 24,49 0 /devices/pseudo/pts@0:49->ttcompat->ldterm->ptem->pts
用法3)lsof -g 26594 显示归属gid的情况
root@patrick.ubuntu.com:/usr/local/home/patrick> lsof -g 26594
COMMAND PID PGID USER FD TYPE DEVICE SIZE/OFF NODE NAME
cat 26594 26594 patrick cwd VDIR 85,40 512 799091 /usr/local/home/patrick
cat 26594 26594 patrick txt VREG 85,40 10260 6034 /usr/bin/cat
cat 26594 26594 patrick txt VREG 85,10 1639036 453 /lib/libc.so.1
cat 26594 26594 patrick txt VREG 85,40 24996 18765 /usr/lib/locale/en_US.ISO8859-1/en_US.ISO8859-1.so.3
cat 26594 26594 patrick txt VREG 85,10 4940 171 /platform/sun4v/lib/libc_psr/libc_psr_hwcap1.so.1
cat 26594 26594 patrick txt VREG 85,10 280840 422 /lib/ld.so.1
cat 26594 26594 patrick 0u VCHR 24,49 0 /devices/pseudo/pts@0:49->ttcompat->ldterm->ptem->pts
cat 26594 26594 patrick 1w VREG 85,40 0 799088 /usr/local/home/patrick/xia
cat 26594 26594 patrick 2u VCHR 24,49 0 /devices/pseudo/pts@0:49->ttcompat->ldterm->ptem->pts
用法4)lsof +d /usr/local/home/patrick 显示目录"/usr/local/home/patrick" 下被进程开启的文件
root@patrick.ubuntu.com:/usr/local/home/patrick> lsof +d /usr/local/home/patrick
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
Xvnc 20428 patrick cwd VDIR 85,40 512 799091 /usr/local/home/patrick
xterm 20435 patrick cwd VDIR 85,40 512 799091 /usr/local/home/patrick
twm 20436 patrick cwd VDIR 85,40 512 799091 /usr/local/home/patrick
bash 20437 patrick cwd VDIR 85,40 512 799091 /usr/local/home/patrick
bash 26300 patrick cwd VDIR 85,40 512 799091 /usr/local/home/patrick
bash 26539 patrick cwd VDIR 85,40 512 799091 /usr/local/home/patrick
bash 26567 root cwd VDIR 85,40 512 799091 /usr/local/home/patrick
cat 26594 patrick cwd VDIR 85,40 512 799091 /usr/local/home/patrick
cat 26594 patrick 1w VREG 85,40 0 799088 /usr/local/home/patrick/xia
lsof 26868 root cwd VDIR 85,40 512 799091 /usr/local/home/patrick
lsof 26869 root cwd VDIR 85,40 512 799091 /usr/local/home/patrick
lsof +D /usr/local/home/patrick 功能和+d差不多,不同的是要同时搜索目录下的目录
用法5) lsof -i 这个用法比较复杂,用来显示符合条件的进程情况,具体用法如下。
lsof -i[4|6] [protocol] [@hostname | hostaddr] [:service | port]
46 --> IPv4 or IPv6
protocol --> TCP or UDP
hostname --> Internet host name
hostaddr --> IPv4位置
service --> /etc/service中的 service name (可以不只一个)
port --> 端口号 (可以不只一个)
lsof tcp@ohaha.ks.edu.tw:ftp -n
查看主机192.168.0.174上哪些进程在使用端口22,即ssh。
root@patrick.ubuntu.com:/usr/local/home/patrick> lsof -i tcp@192.168.0.174:22 -n
用法6) lsof -u UID
如:lsof -u patrick
用法7) lsof -p 26869 显示进程号为26869的进程打开的文件