repository·master·Indexed 20 days ago
https://github.com/lsof-org/lsofA command-line utility used to list all files currently opened by processes on a system. It is used for debugging resource usage, identifying processes using specific files, and troubleshooting network connections. The documentation covers usage flags (such as -p, -n, -P, and -b), performance optimization for device scans, build and test instructions from source, and troubleshooting for various UNIX dialects including Linux, AIX, FreeBSD, Darwin, and Solaris.
lsof is actively maintained and supported on the following platforms:
It is also available for legacy systems like IBM AIX, HP-UX, SCO OpenServer, and UnixWare, though these are not actively maintained.
lsof may be unable to report file offsets because the underlying data access method (e.g., /proc-based access) does not provide them. In these cases, tests like LTbigf or LTszoff will issue a warning and skip offset-specific tests, performing only size tests.On many dialects (FreeBSD, HP-UX, Linux, NetBSD, SCO OpenServer, SCO|Caldera UnixWare, Solaris, and Tru64 UNIX), lsof can extract recently used path name components from the kernel's name cache.
Note on reporting format:
lsof reports complete paths in the NAME column.-, and then the located name components separated by /.When lsof encounters an open block or character file whose device, raw device, and inode place it outside of /dev or /devices, it reports the file system name and device/path, followed by (like block special <path>) or (like character special <path>).
The <path> points to a device in /dev (or /devices) whose raw device number matches the open file, but whose device or node number does not. This indicates the file is connected to a device node created in a directory other than the standard /dev (typically via mknod(8)).
Most UNIX versions of lsof support 8-bit language locale characters (e.g., accents).
machine.h header for the HASSETLOCALE definition. If present, support is available.LANG to a value supported by your system (e.g., en_US). Note that LANG=C and LANG=POSIX do not support marked characters.If HASWIDECHAR is defined in the dialect's machine.h, lsof can print wide characters (like UTF-8) when iswprint(3) reports them as printable.
Supported dialects with wide character support include:
lsof reports file locks using a single character as a compromise between kernel data and reporting limitations:
R, W, X).r, w, x).Limitations:
lsof only reports the status of the first lock encountered.lsof generally only reports locks held by local processes on local files. Remote locks (e.g., on NFS) are typically not reported, except on certain Solaris versions.The ability to list all open files is controlled by how lsof was compiled.
HASSECURITY is defined: Only the root user can list all open files. Non-root users can only list open files belonging to processes with the same User ID (UID) as the user who executed lsof.HASSECURITY and HASNOSOCKSECURITY are both defined: Anyone can list open socket files if they are specifically selected using the -i option.HASSECURITY is NOT defined: Any user can list all open files on the system.You can check the status of these security definitions by running lsof -h or lsof -?.
The project uses two testing mechanisms:
tests/00README.tests/case-00-hello.bash.Placement of tests:
tests/.tests/dialects/<dialect>/tests/ (e.g., tests/dialects/linux/tests/).When running lsof, you may see two processes in your process list: the original lsof process and a child process. The child process is used to isolate the parent from kernel functions that can block (e.g., readlink(), stat(), or reading from /dev devices).
Information is exchanged via pipes. If the parent detects the child has become blocked, it attempts to kill the child to prevent the parent from hanging.
To avoid these blocks, you can use specific lsof options, but use caution as this may be risky for system stability. Refer to the BLOCKS AND TIMEOUTS and AVOIDING KERNEL BLOCKS sections of the lsof man page for details.
COMMAND PID USER FD TYPE DEVICE ...
...
lsof 29450 abe 7w PIPE 0x48732408 ...
lsof 29450 abe 8r PIPE 0x48970808 ...
...
lsof 29451 abe 6r PIPE 0x48732408 ...
lsof 29451 abe 9w PIPE 0x48970808 ...If lsof reports messages like can't read inpcb at 0x..., no protocol control block, or no PCB, CANTSENDMORE, CANTRCVMORE in the NAME column for TCP sockets, it indicates that the socket structure lacks a pointer to the Internet Protocol Control Block (inpcb).
This typically happens when a socket has been submitted to the shutdown(2) function for processing. In some implementations, the error message attempts to explain the absence of the PCB by showing the socket state settings resulting from the shutdown(2) call.
When providing names (path names of specific files), lsof behaves as follows:
lsof lists all files open on that file system. Use +f to force a name to be treated as a file system identifier, or -f to force it to be treated as a simple file.+d s or +D D./dev/pt[cs]), lsof lists all associated multiplexed files (e.g., /dev/pt[cs]/1).lsof matches the exact characters of the name as recorded in the kernel./) and is recorded in /proc/net/unix, lsof can search using a relative path (e.g., ./log for /dev/log) by matching device and inode numbers via stat(2).Portmap registration reporting (enabled via +M) displays registrations in square brackets following the port or service name (e.g., :1234[name]).
Key behaviors:
lsof only reports registrations for local TCP/UDP ports. A port is considered local if it appears in the local address section of the kernel structure, or if the foreign address is the same as the local address, or if the foreign address is INADDR_LOOPBACK (127.0.0.1).lsof ignores foreign portmapped ports to avoid long network delays or being blocked by firewalls.lsof -h to see the default for your build. You can explicitly enable it with +M or disable it with -M.