|
|
 |
|
|
MAN page from Old RedHat 6.X lsof-4.45-1.i386.rpm
LSOFSection: Maintenance Commands (8) Updated: Revision-4.45 Index NAMElsof - list open files SYNOPSISlsof[ -?abChlnNOPRstUvVX] [ -A A] [ -c c] [ +|-d d] [ +|-D D] [ +|-f [cfgGn]] [ -F [f]] [ -g [s]] [ -i [i]] [ -k k] [ +|-L [l]] [ -m m] [ +|-M] [ -o [o]] [ -p s] [ +|-r [t]] [ -S [t]] [ -T [t]] [ -u s] [ +|-w] [ --] [ names] DESCRIPTIONLsofrevision 4.45 lists information about files opened by processes for thefollowing UNIX dialects: AIX 4.1.[45], 4.2[.1], and 4.3[.12] BSDI BSD/OS 2.1 and 3.[01] for Intel-based systems DC/OSx 1.1 for Pyramid systems DEC OSF/1, Digital UNIX, Tru64 UNIX 2.0, 3.2, 4.0, and 5.0 FreeBSD 2.1.[67], 2.2[.x], 3.[012], and 4.0 for Intel-based systems HP-UX 9.01, 10.20, and 11.00 Linux 2.0.3[2346], 2.1.x, and 2.2.x for Intel-based systems NetBSD 1.[234] for Intel and SPARC-based systems NEXTSTEP 3.[13] for NEXTSTEP architectures OpenBSD 2.[012345] for Intel-based systems OpenStep 4.x Reliant UNIX 5.4[34] for Pyramid systems SCO OpenServer Release 3.0 and 5.0.[0245] for Intel-based systems SCO UnixWare 2.1.[123] and 7[[.0].1] for Intel-based systems Sequent PTX 2.1.9, 4.2.[13], 4.[34], and 4.4[.124] for Sequent systems Solaris 2.5.1, 2.6, and 7 SunOS 4.1.x Ultrix 4.2 (See theDISTRIBUTIONsection of this manual page for information on how to obtain thelatestlsofrevision.) An open file may be a regular file, a directory, a block special file,a character special file, an executing text reference, a library,a stream or a network file (Internet socket, NFS file or UNIX domain socket.)A specific file or all the files in a file system may be selected by path. Instead of a formatted display,lsofwill produce output that can be parsed by other programs.See the-F,option description, and theOUTPUT FOR OTHER PROGRAMSsection for more information. In addition to producing a single output list,lsofwill run in repeat mode.In repeat mode it will produce output, delay, then repeat the outputoperation until stopped with an interrupt or quit signal.See the+|-r [t]option description for more information. OPTIONSIn the absence of any options, lsoflists all open files belonging to all active processes. If any list request option is specified, other list requests must bespecifically requested - e.g., if-Uis specified for the listing of UNIX socket files, NFS files won't belisted unless-Nis also specified;or if a user list is specified with the-uoption, UNIX domain socket files, belonging to users not in the list,won't be listed unless the-Uoption is also specified. Normally list options that are specifically stated are ORed - i.e.,specifying the-ioption without an address and the -ufoo option produces alisting of all network files OR files belonging to processes ownedby user ``foo''.One exception is the `^' (negated) login name or user ID (UID)specified with the-uoption.Since it is an exclusion, it is applied without ORing or ANDingand takes effect before any other selection criteria are applied. The-aoption may be used to AND the selections.For example, specifying-a,-U,and -ufoo produces a listing of only UNIX socket files thatbelong to processes owned by user ``foo''. Caution: the-aoption causes all list selection options to be ANDed; it can'tbe used to cause ANDing of selected pairs of selection optionsby placing it between them, even though its placement there isacceptable.Wherever-ais placed, it causes the ANDing of all selection options. Items of the same selection set - command names, file descriptors,network addresses, process identifiers, user identifiers - are joinedin a single ORed set and applied before the result participates inANDing.Thus, for example, specifying -i@aaa.bbb, -i@ccc.ddd,-a,and -ufff,ggg will select the listing of files that belong toeither login ``fff'' OR ``ggg'' AND have network connections to eitherhost aaa.bbb OR ccc.ddd. Options may be grouped together following a single prefix -- e.g.,the option set ``-a -b -C'' may be stated as-abC.However, since values are optional following +|-f,-F,-g,-i,+|-L,-o,+|-r,-S,and-T,when you have no values for them be careful that thefollowing character isn't ambiguous.For example,-Fnmight represent the-Fand-noptions, or it might represent thenfield identifier character following the-Foption.When ambiguity is possible, start a new option with a `-'character - e.g., ``-F -n''.If the next option is a file name, follow the possibly ambiguousoption with ``--'' - e.g., ``-F -- name''. Either the `+' or the `-' prefix may be applied to a group of options.Options that don't take on separate meanings for eachprefix - e.g., -i - may be grouped under either prefix.Thus, for example, ``+M -i'' may be stated as ``+Mi'' and the groupmeans the same as the separate options.Be careful of prefix grouping when one or more options in the groupdoes take on separate meanings under different prefixes -e.g., +|-M; ``-iM'' is not the same request as ``-i +M''.When in doubt, use separate options with appropriate prefixes. - -? -h
- These two equivalent options select a usage (help) output list.Lsofdisplays a shortened form of this output when it detects an errorin the options supplied to it, after it has displayed messagesexplaining each error.(Escape the `?' character as your shell requires.)
- -a
- This option causes list selection options to be ANDed, as describedabove.
- -A A
- This option is available on systems configured for AFS whose AFSkernel code is implemented via dynamic modules.It allows thelsofuser to specifyAas an alternate name list file where the kernel addresses of the dynamicmodules might be found.See the00FAQfile of thelsofdistribution for more information about dynamic modules, theirsymbols, and how they affectlsof.
- -b
- This option causeslsofto avoid kernel functions that might block -lstat(2),readlink(2),andstat(2).
- See theBLOCKS AND TIMEOUTSandAVOIDING KERNEL BLOCKSsections for information on using this option.
- -c c
- This option selects the listing of files for processes executing thecommand that begins with the characters ofc.Multiple commands may be specified, using multiple-coptions.They are joined in a single ORed set before participating inAND option selection.
- -C
- This option disables the reporting of any path namecomponents from the kernel's name cache.See theKERNEL NAME CACHEsection for more information.
- +d s
- This option causeslsofto search for all open instances of directorysand the files and directories it contains at its top level.This option does NOT descend the directory tree, rooted ats,nor does it follow symbolic links within it.The+D Doption may be used to request a full-descent directory tree search,rooted at directoryD.
- Note: the authority of the user of this option limits it to searching forfiles that the user has permission to examine with the systemstat(2)function.
- -d s
- This option selects the listing of files whose file descriptorsare in the comma-separated sets- e.g., ``1,3'' or ``6,cwd,2''.(There should be no spaces in the set.)
- A file descriptor number range may be included in the set as long asneither member is empty, both members are numbers, and the endingmember is larger than the starting one - e.g., ``0-7'' or ``3-10''.
- Multiple file descriptor numbers are joined in a single ORed set beforeparticipating in AND option selection.
- See the description of File Descriptor (FD) output values in theOUTPUTsection for more information on file descriptor names.
- +D D
- This option causeslsofto search for all open instances of directoryDand all the files and directories it contains to its complete depth.Symbolic links within directoryDare ignored - i.e, not followed.
- Note: the authority of the user of this option limits it to searching forfiles that the user has permission to examine with the systemstat(2)function.
- Further note:lsofmay process this option slowly and require a large amount of dynamic memoryto do it.This is because it must descend the entire directory tree, rooted atD,callingstat(2)for each file and directory, building a list of all the files it finds, andsearching that list for a match with every open file.When directoryDis large, these steps can take a long time, so use this option prudently.
- -D D
- This option directslsof'suse of the device cache file.The use of this option is sometimes restricted.See theDEVICE CACHE FILEsection and the sections that follow it for more information on thisoption.
- -Dmust be followed by a function letter; the function letter may optionallybe followed by a path name.Lsofrecognizes these function letters:
? - report device cache file paths b - build the device cache file i - ignore the device cache file r - read the device cache file u - read and update the device cache file - Theb,r,andufunctions, accompanied by a path name, are sometimes restricted.When these functions are restricted, they will not appear inthe description of the-Doption that accompanies-hor-?option output.See theDEVICE CACHE FILEsection and the sections that follow it for more information on thesefunctions and when they're restricted.
- The?function reports the read-only and write paths that lsof canuse for the device cache file,the names of any environment variables whose valueslsofwill examine when forming the device cache file path,and the format for the personal device cache file path.(Escape the `?' character as your shell requires.)
- When available, theb,r,andufunctions may be followed by the device cache file's path.The standard default is.lsof_hostnamein the home directory of the real user ID that executeslsof,but this could have been changed whenlsofwas configured and compiled.(The output of the-hand-?options show the current default prefix - e.g., ``.lsof''.)The suffix,hostname,is the first component of the host's name returned bygethostname(2).
- When available, thebfunction directslsofto build a new device cache file at the default or specified path.
- Theifunction directslsofto ignore the default device cache file and obtain its informationabout devices via direct calls to the kernel.
- Therfunction directslsofto read the device cache at the default or specified path, butprevents it from creating a new device cache file when noneexists or the existing one is improperly structured.Therfunction, when specified without a path name, preventslsoffrom updating an incorrect or outdated device cache file,or creating a new one in its place.Therfunction is always available when it is specified without apath name argument; it may be restricted by the permissions of thelsofprocess.
- When available, theufunction directslsofto read the device cache file at the default or specified path,if possible, and to rebuild it, if necessary.This is the default device cache file function when no-Doption has been specified.lsofrepetitively from a shell script, for example.
- +|-f [cfgGn]
- fby itself clarifies how path name arguments are to be interpreted.When followed byc,f,g,G,ornin any combination it specifiesthat the listing of kernel file structure information is to be enabled(`+') or inhibited (`-').
- Normally a path name argument is taken to be a file system name ifit matches a mounted-on directory name reported bymount(8),or if it represents a block device, named in themountoutput and associated with a mounted directory name.When+fis specified, all path name arguments will be taken to be filesystem names, andlsofwill complain if any are not.This can be useful, for example, when the file system name(mounted-on device) isn't a block device.This happens for some CD-ROM file systems.
- When-fis specified, all path name arguments will be taken to be simple files.Thus, for example, the ``-f /'' arguments direct lsof to searchfor open files with a `/' path name, not all open files in the `/'(root) file system.
- Be careful to make sure+fis properly terminated and isn't followed by a character (e.g., ofthe file or file system name) that might be taken as a parameter.For example, use ``--'' after+fas in this example.
$ lsof +f -- /file/system/name - The listing of information from kernel file structures, requested with the+f [cfgGn]option form, is normallyinhibited, and is not available for some dialects - e.g., /proc-basedLinux.When the prefix tofis a plus sign (`+'), these characters request file structure information:
c file structure use count f file structure address g file flag abbreviations G file flags in hexadecimal n file structure node address - When the prefix is minus (`-') the same characters disable thelisting of the indicated values.
- File structure addresses, use counts, flags, and node addresses may beused to detect more readily identical files inherited by childprocesses and identical files in use by different processes.Lsofcolumn output can be sorted by output columns holding the valuesand listed to identify identifical file use, orlsoffield output can be parsed by an AWK or Perl post-filter script.
- -F f
- This option specifies a character list,f,that selects the fields to be output for processing by another program,and the character that terminates each output field.Each field to be output is specified with a single character inf.The field terminator defaults to NL, but may be changed to NUL (000).See theOUTPUT FOR OTHER PROGRAMSsection for a description of the field identification characters andthe field output process.
- When the field selection character list is empty, all fields areselected and the NL field terminator is used.
- When the field selection character list contains only a zero (`0'),all fields are selected and the NUL terminator character is used.
- Other combinations of fields and their associated field terminatorcharacter must be set with explicit entries inf,as described in theOUTPUT FOR OTHER PROGRAMSsection.
- When the field selection character list contains the singlecharacter `?',lsofwill display a help list of the field identification characters.(Escape the `?' character as your shell requires.)
- -g [s]
- This option selects the listing of files for the processes whose optionalprocess group IDentification (PGRP) numbers are in the comma-separatedsets- e.g., ``123'' or ``123,456''.(There should be no spaces in the set.)
- Multiple PGRP numbers are joined in a single ORed set before participatingin AND option selection.
- The-goption also enables the output display of PGRP numbers.When specified without a PGRP set that's all it does.
- -i [i]
- This option selects the listing of files any of whose Internet addressmatches the address specified in i.If no address is specified, this option selects the listing of allInternet and x.25 (HP-UX) network files.
- Multiple addresses (up to a limit of 100) may be specified with multiple-ioptions.(A port number or service name range is counted as one address.)They are joined in a single ORed set before participating inAND option selection.
- An Internet address is specified in the form:
- [protocol][@hostname|hostaddr][:service|port]
- where:
protocol is a protocol name - TCP or UDP.
hostname is an Internet host name.
hostaddr is a numeric Internet IPv4 address in
dot form; or an IPv6 numeric address in colon
form, enclosed in brackets.
service is an /etc/services name - e.g., smtp - or list of them.
port is a port number, or list of them.
- IPv6 numeric host addresses may be specified only if the UNIXdialect supports them.To see if the dialect supports IPv6 addresses, runlsofand specify the-hor-?(help) option.If the displayed description of the-ioption contains ``IPv[46]'', IPv6 addresses are supported.
- At least one address component -protocol,host specification, service or port specification - must be supplied.The `@' character, leading the host specification, is always required;as is the `:', leading the port specification.Specify eitherhostnameorhostaddr.Specify eitherservicename list orportnumber list.If aservicename list is specified, theprotocolmay also need to be specified if the TCP and UDP port numbers forthe service name are different.Use any case - lower or upper - forprotocol.
- Servicenames andportnumbers may be combined in a list whose entries are separated by commasand whose numeric range entries are separated by minus signs.There may be no embedded spaces, and all service names must belong tothe specifiedprotocol.Since service names may contain embedded minus signs, the staring entryof a range can't be a service name; it can be a port number, however.
- Here are some sample addresses:
TCP:25 - TCP and port 25
@1.2.3.4 - Internet IPv4 host address 1.2.3.4
@[3ffe:1ebc::1]:1234 - Internet IPv6 host address 3ffe:1ebc::1, port 1234
UDP:who - UDP who service port
TCPAATTvic.cc:513 - TCP, port 513 and host name vic.cc
tcp@foo:1-10,smtp,99 - TCP, ports 1 through 10, service name smtp, port 99, host name foo
tcp@bar:smtp-nameserver - TCP, ports smtp through nameserver, host bar
:time - either TCP or UDP time service port
- -k k
- This option specifies a kernel name list file,k,in place of /vmunix, /mach, etc.This option is not available under AIX on the IBM RISC/System 6000.
- -l
- This option inhibits the conversion of user ID numbers to login names.It is also useful when login name lookup is working improperly or slowly.
- +|-L [l]
- This option enables (`+') or disables (`-') the listing of file linkcounts, where they are available - e.g., they aren't availablefor sockets, or most FIFOs and pipes.
- When+Lis specified without a following number, all link counts will be listed.When-Lis specified (the default), no link counts will be listed.
- When+Lis followed by a number, only files having a link count less thanthat number will be listed.(No number may follow-L.)A specification of the form ``+L1'' will select open files thathave been unlinked.A specification of the form ``+aL1 <file_system>'' will selectunlinked open files on the specified file system.
- For other link count comparisons, use field output (-F)and a post-processing script.
- -m m
- This option specifies a kernel memory file,c,in place of/dev/kmemor/dev/mem- e.g., a crash dump file.
- +|-M
- Enables (+) or disables (-) thereporting of portmapper registrations for local TCP and UDP ports.The default reporting mode is set by thelsofbuilder with the HASPMAPENABLED #define in the dialect's machine.hheader file;lsofis distributed with the HASPMAPENABLED #define deactivated, soportmapper reporting is disabled by default and must be requestedwith+M.Specifyinglsof's-hor-?option will report the default mode.Disabling portmapper registration when it is already disabled orenabling it when already enabled is acceptable.in a warning.
- When portmapper registration reporting is enabled,lsofdisplays the portmapper registration (if any) for local TCP or UDP portsin square brackets immediately following the port numbers or servicenames - e.g., ``:1234[name]'' or ``:name[100083]''.The registration information may be a name or number, dependingon what the registering program supplied to the portmapper whenit registered the port.
- When portmapper registration reporting is enabled,lsofmay run a little more slowly or even become blocked when access to theportmapper becomes congested or stopped.Reverse the reporting mode to determine if portmapper registrationreporting is slowing or blockinglsof.
- For purposes of portmapper registration reportinglsofconsiders a TCP or UDP port local if: it is found in the local partof its containing kernel structure;or if it is located in the foreign part of its containing kernelstructure and the local and foreign Internet addresses are the same;or if it is located in the foreign part of its containing kernelstructure and the foreign Internet address is INADDR_LOOPBACK (127.0.0.1).This rule may makelsofignore some foreign ports on machines with multiple interfaceswhen the foreign Internet address is on a different interfacefrom the local one.
- See the00FAQfile of thelsofdistribution for further discussion of portmapper registrationreporting issues.
- -n
- This option inhibits the conversion of network numbers to host names for network files.Inhibiting conversion may makelsofrun faster.It is also useful when host name lookup is not working properly.
- -N
- This option selects the listing of NFS files.
- -o
- This option directslsofto display file offset at all times.It causes the SIZE/OFF output column title to be changed to OFFSET.
- The-oand-soptions are mutually exclusive; they can't both be specified.When neither is specified,lsofdisplays whatever value - size or offset - is appropriate andavailable for the type of the file.
- -o o
- This option defines the number of decimal digits (o) to beprinted after the ``0t'' for a file offset before the form is switchedto ``0x...''.Anovalue of zero (unlimited) directslsofto use the ``0t'' form for all offset output.
- This option does NOT directlsofto display offset at all times; specify-o(without a trailing number) to do that.This option only specifies the number of digits after ``0t'' ineither mixed size and offset or offset-only output.Thus, for example, to directlsofto display offset at all times with a decimal digit count of 10, use:
-o -o 10or -oo10 - The default number of digits allowed after ``0t'' is normally 8,but may have been changed by the lsof builder.Consult the description of the-o ooption in the output of the-hor-?option to determine the default that is in effect.
- -O
- This option directslsofto bypass the strategy it uses to avoid being blocked by somekernel operations - i.e., doing them in forked child processes.See theBLOCKS AND TIMEOUTSandAVOIDING KERNEL BLOCKSsections for more information on kernel operations that may blocklsof.
- While use of this option will reducelsofstartup overhead, it may also causelsofto hang when the kernel doesn't respond to a function.Use this option cautiously.
- -p s
- This option selects the listing of files for the processes whose ID numbersare in the comma-separated sets- e.g., ``123'' or ``123,456''.(There should be no spaces in the set.)
- Multiple process ID numbers are joined in a single ORed set beforeparticipating in AND option selection.
- -P
- This option inhibits the conversion of port numbers to portnames for network files.Inhibiting the conversion may makelsofrun a little faster.It is also useful when host name lookup is not working properly.
- +|-r [t]
- This option putslsofin repeat mode.Therelsoflists open files as selected by other options, delaystseconds (default fifteen), then repeats the listing, delayingand listing repetitively until stopped with an interrupt or quit signal.
- The prefix determines the way repeat mode can end.If the prefix is a `-', repeat mode is endless.Lsofmust be terminated with an interrupt or quit signal.
- If the prefix is `+', repeat mode will end the first cycle no open filesare listed - and of course whenlsofis stopped with an interrupt or quit signal.When repeat mode ends because no files are listed, the process exit codewill be zero if any open files were ever listed; one, if none were everlisted.
- Lsofmarks the end of each listing:if field output is in progress (the-F,option has been specified), the marker is `m'; otherwise the markeris ``========''.The marker is followed by a NL character.
- Repeat mode reduceslsofstartup overhead, so it is more efficient to use this modethan to calllsofrepetitively from a shell script, for example.
- To use repeat mode most efficiently, accompany+|-rwith specification of otherlsofselection options, so the amount of kernel memory accesslsofdoes will be kept to a minimum.Options that filter at the process level - e.g.,-c,-g,-p,-u- are the most efficient selectors.
- Repeat mode is useful when coupled with field output (see the-F,option description) and a supervisingawkorPerlscript.
- -R
- This option directs lsof to list the Parent Process IDentificationnumber in the PPID column.
- -s
- This option directslsofto display file size at all times.It causes the SIZE/OFF output column title to be changed to SIZE.If the file does not have a size, nothing is displayed.
- The-o(without a following decimal digit count) and-soptions are mutually exclusive; they can't both be specified.When neither is specified,lsofdisplays whatever value - size or offset - is appropriate andavailable for the type of file.
- -S [t]
- This option specifies an optional time-out seconds value for kernel functions -lstat(2),readlink(2),andstat(2)- that might otherwise deadlock.The minimum fortis two;the default, fifteen; when no value is specified, the default is used.
- See theBLOCKS AND TIMEOUTSsection for more information.
- -T [t]
- This option controls the reporting of some TCP/TPI information, alsoreported bynetstat(1),following the network addresses.In normal output the information appears in parentheses, each itemexcept state identified by a keyword, followed by `=', separated fromothers by a single space:
<TCP or TPI state name> QR=<read queue length> QS=<send queue length> WR=<window read length> (Solaris only) WW=<window write length> (Solaris only) - When the field output mode is in effect (SeeOUTPUT FOR OTHER PROGRAMS.)each item appears as a field with a `T' leading character, and theTCP or TPI state name has the prefix ``ST=''.
- -Twith no following key characters disables TCP/TPI information reporting.
- -Twith following characters selects the reporting of specific TCP/TPIinformation:
q selects queue length reporting. s selects state reporting. w selects window size reporting (Solaris only). - State is reported by default.When-Tis used to select information - i.e., it is followed by one or moreselection characters - the displaying of state is disabled by default,and it must be explicitly selected again in the characters following-T.(In effect, then, the default is equivalent to-Ts.)For example, if queue lengths and state are desired, use-Tqs.
- -t
- This option specifies thatlsofshould produce terse output with process identifiers only and no header -e.g., so that the output may be piped tokill(1).This option selects the-woption.
- -u s
- This option selects the listing of files for the user whose login namesor user ID numbers are in the comma-separated sets- e.g., ``abe'',or ``548,root''.(There should be no spaces in the set.)
- Multiple login names or user ID numbers are joined in a single ORed setbefore participating in AND option selection.
- If a login name or user ID is preceded by a `^', it becomes a negation -i.e., files of processes owned by the login name or user ID will neverbe listed.A negated login name or user ID selection is neither ANDed nor ORedwith other selections; it is applied before all other selections andabsolutely excludes the listing of the files of the process.For example, to directlsofto exclude the listing of files belonging to root processes,specify ``-u^root'' or ``-u^0''.
- -U
- This option selects the listing of UNIX domain socket files.
- -v
- This option selects the listing oflsofversion information, including: revision number;when thelsofbinary was constructed;who constructed the binary and where;the name of the compiler used to construct thelsof binary;the version number of the compiler when readily available;the compiler and loader flags used to construct thelsofbinary;and system information, typically the output ofuname's-aoption.
- -V
- This option directslsofto indicate the items it was asked to list and failed to find - commandnames, file names, Internet addresses or files, login names, NFS files,PIDs, PGRPs, and UIDs.
- When other options are ANDed to search options,lsofmay not report that it failed to find a search item when an ANDedoption prevents the listing of the open file containing the locatedsearch item.For example, ``lsof -V -iTCPAATTfoobar -a -d 999'' may not report afailure to locate open files at ``TCPAATTfoobar'' and may not listany, if none have a file descriptor number of 999.
- +|-w
- Enables (+) or disables (-) the suppression of warning messages.
- Thelsofbuilder may choose to have warning messages disabled or enabled bydefault.The default warning message state is indicated in the output of the-hor-?option.Disabling warning messages when they are already disabled or enablingthem when already enabled is acceptable.
- The-toption selects the-woption.
- -X
- This is a dialect-specific option.
- AIX:
- WARNING:
- use of this option on a busy AIX system might cause an applicationprocess to hang so completely that it can neither be killed nor stopped.I have never seen this happen or had a report of it, but I think thepossibility exists.
- This IBM AIX RISC/System 6000-Xoption directslsofto use the kernel readx() function.By default use of readx() is disabled.
- Thelsofbuilder may specify that the-Xoption be restricted to processes whose real UID is root.If that has been done, the-Xoption will not appear in the-hor-?help output unless the real UID of thelsofprocess is root.The defaultlsofdistribution allows any UID to specify-X,so by default it will appear in the help output.
- When AIX readx() useis disabled,lsofmay not be able to report information for all text and loader filereferences, but it may also avoid exacerbating an AIXkernel directory search kernel error, known as the Stale SegmentID bug.
- When readx() is enabled,lsofwill attempt to report information on the text file being executedby each process and the shared libraries it uses.
- The readx() function, used bylsofor any other program, to access some sections of kernel virtualmemory, can trigger the Stale Segment ID bug.It can cause the kernel's dir_search() function erroneously to believethat part of an in-memory copy of a file system directory has beenzeroed.Another application process, distinct fromlsof,asking the kernel to search the directory - e.g., by usingopen(2) -can cause dir_search() to loop forever, thus hanging the application process.
- Consult the00FAQand00READMEfiles of thelsofdistribution for a more complete description of the Stale Segment ID bug,its APAR, and methods for defining readx() use when compilinglsof.
- PTX:
- This Sequent PTX-Xoption directslsofto list the file use count and inode address from the file structure.Its effect is equivalent to+fcfwith these exceptions: the NODE-ID column title will be changedto INODE-ADDR; and the only value listed in the INODE-ADDR column willbe the kernel inode structure address for files that use an inode.
- The file use count (decimal) indicates the number of concurrent users ofthe file descriptor.The kernel inode address (hexadecimal) is a value sometimes usefulwhen working with a malfunctioning system.(Also see the manual page for the PTXcrash(1)application.)
- --
- The double minus sign option is a marker that signals the end ofthe keyed options.It may be used, for example, when the first file name begins witha minus sign.It may also be used when the absence of a value for the last keyedoption must be signified by the presence of a minus sign in the followingoption and before the start of the file names.
- names
- These are path names of specific files to list.Symbolic links are resolved before use.The first name may be separated from the preceding options withthe ``--'' option.
- If aname is the mounted-on directory of a file system or the device of thefile system,lsofwill list all the files open on the file system.To be considered a file system, thenamemust match a mounted-on directory name inmount(8)output, or match the name of a block device associated with a mounted-ondirectory name.The+|-foption may be used to forcelsofto consider anamea file system identifier (+f) or a simple file (-f).
- Ifnameis a path to a directory that is not the mounted-on directory name ofa file system, it is treated just as a regular file is treated - i.e.,its listing is restricted to processes that have it open as a file oras a process-specific directory, such as the root or current workingdirectory.To request thatlsoflook for open files inside a directory name, use the+d sand+D Doptions.
- If anameis the base name of a family of multiplexed files - e. g, AIX's/dev/pt[cs] -lsofwill list all the associated multipled files on the device thatare open - e.g.,/dev/pt[cs]/1,/dev/pt[cs]/2,etc.
- If anameis a UNIX domain socket name,lsofwill search for it by the characters of the name alone - both asspecified and as resolved from symbolic links.When the socket uses a name that is a symbolic link to another, youmust specify the name the socket uses.However, if the socket uses the symbolic link's resolution, youmay specify it or the symbolic link origination.When askinglsofto search for a UNIX domain socket name, be careful to specifyits absolute path, just as it appears in kernel structures.Specifying a relative path - e.g.,./file- in place of thefile's absolute path - e.g.,/tmp/file- won't work becauselsofmust match the characters you specify with what it finds inthe kernel structures associated with UNIX domain sockets.
- If anameis none of the above,lsofwill list any open files whose device and inode match that of thespecified pathname.
- If you have also specified the-boption,the onlynamesyou may safely specify are file systems for which your mount tablesupplies alternate device numbers.See theAVOIDING KERNEL BLOCKSandALTERNATE DEVICE NUMBERSsections for more information.
- Multiple file names are joined in a single ORed set beforeparticipating in AND option selection.
AFSLsofsupports the recognition of AFS files for these dialects (and AFSversions): AIX 4.1.4 (AFS 3.4a) HP-UX 9.0.5 (AFS 3.4a) Linux 1.2.13 (AFS 3.3) Solaris 2.[56] (AFS 3.4a) SunOS 4.1.4 (AFS 3.3a) Ultrix 4.2 RISC (AFS 3.2b) It may recognize AFS files on other versions of these dialects,but has not been tested there.Depending on how AFS is implemented,lsofmay recognize AFS files in other dialects, or may have difficultiesrecognizing AFS files in the supported dialects. Lsofmay have trouble identifying all aspects of AFS files insupported dialects when AFS kernel support is implemented viadynamic modules whose addresses do not appear in the kernel'svariable name list.In that case,lsofmay have to guess at the identity of AFS files, and might not be able toobtain volume information from the kernel that is needed for calculatingAFS volume node numbers.Whenlsofcan't compute volume node numbers, it reports blank in the NODE column. The-A Aoption is available in some dialect implementations oflsoffor specifying the name list file where dynamic module kerneladdresses may be found.When this option is available, it will be listed in thelsofhelp output, presented in response to the-hor-? See the00FAQfile of thelsofdistribution for more information about dynamic modules, theirsymbols, and how they affectlsofoptions. Because AFS path lookups don't seem to participate in thekernel's name cache operations,lsofcan't identify path name components for AFS files. SECURITYLsofhas three features that may cause security concerns.First, its default compilation mode allows anyone to list allopen files with it.Second, by default it creates a user-readable and user-writable devicecache file in the home directory of the real user ID that executes lsof.(The list-all-open-files and device cache features may be disabled when lsofis compiled.)Third, its -kand -moptions name alternate kernel name list or memory files. Restricting the listing of all open files is controlled by thecompile-time HASSECURITY option.When HASSECURITY is defined,lsofwill allow only the root user to list all open files.The non-root user may list only open files of processes with the same userIDentification number as the real user ID number of thelsofprocess (the one that its user logged on with).When HASSECURITY is not defined, anyone may list all open files. Help output, presented in response to the-hor-?option, gives the HASSECURITY definition status. See theSecuritysection of the0READMEfile of thelsofdistribution for information on buildinglsofwith the HASSECURITY option enabled. Creation and use of a user-readable and user-writable devicecache file is controlled by the compile-time HASDCACHE option.See theDEVICE CACHE FILEsection and the sections that follow it for details on how its pathis formed.For security considerations it is important to note that in the defaultlsofdistribution, if the real user ID under whichlsofis executed is root, the device cache file will be written in root'shome directory - e.g.,/or/root.When HASDCACHE is not defined,lsofdoes not write or attempt to read a device cache file. When HASDCACHE is defined, thelsofhelp output, presented in response to the-h,-D?,or-?options, will provide device cache file handling information.When HASDCACHE is not defined, the-hor-?output will have no-Doption description. Before you decide to disable the device cache file feature - enablingit improves the performance oflsofby reducing the startup overhead of examining all the nodes in/dev(or/devices)- read the discussion of it in the00DCACHEand00FAQfiles of thelsofdistribution. WHEN IN DOUBT, YOU CAN TEMPORARILY DISABLE THE USE OF THE DEVICE CACHE FILEWITH THE-DiOPTION. Whenlsofuser declares alternate kernel name list or memory files with the-kand-moptions,lsofchecks the user's authority to read them withaccess(2).This is intended to prevent whatever special powerlsof'smodes might confer on it from letting it read files not normallyaccessible via the authority of the real user ID. OUTPUTThis section describes the information lsoflists for each open file.See the OUTPUT FOR OTHER PROGRAMSsection for additional information on output that can be processedby another program. Lsofonly outputs printable ASCII characters.Non-printable characters are printed in one of three forms:the C ``\[bfrnt]'' form;the control character `^' form (e.g., ``^@'');or hexadecimal leading ``\x'' form (e.g., ``\xab'').Space is non-printable in the COMMAND column (``\x20'')and printable elsewhere. Lsofdynamically sizes the output columns each time it runs, guaranteeingthat each column is a minimum size.It also guarantees that each column is separated from its predecessorby at least one space. - COMMAND
- contains the first nine characters of the name of the UNIX commandassociated with the process.
- All command name characters maintained by the kernel in its structuresare displayed in field output when the command name descriptor (`c')is specified.See theOUTPUT FOR OTHER COMMANDSsection for information on selecting field output and the associatedcommand name descriptor.
- PID
- is the Process IDentification number of the process.
- PPID
- is the Parent Process IDentification number of the process.It is only displayed when the-Roption has been specified.
- PGRP
- is the process group IDentification number associated withthe process.It is only displayed when the-goption has been specified.
- USER
- is the user ID number or login name of the user to whom the processbelongs, as reported byps(1).(See the-loption description.)
- FD
- is the File Descriptor number of the file or:
cwd current working directory;
Lnn library references;
ltx shared library text (code and data);
Mxx hex memory-mapped type number xx.
m86 DOS Merge mapped file;
mem memory-mapped file;
pd parent directory;
rtd root directory;
txt program text (code and data);
v86 VP/ix mapped file; - FD is followed by one of these characters, describing the mode under whichthe file is open:
- r for read access;
w for write access;
u for read and write access;
space if unknown and no lock character;
`-' if unknown and lock character.
- The mode character is followed by one of these characters, describingthe type of lock applied to the file:
- N for a Solaris NFS lock of unknown type;
r for read lock on part of the file;
R for a read lock on the entire file;
w for a write lock on part of the file;
W for a write lock on the entire file;
u for a read and write lock of any length;
U for a lock of unknown type;
x for an SCO OpenServer Xenix lock on part
of the file;
X for an SCO OpenServer Xenix lock on the
entire file;
space if there is no lock.
- See theLOCKSsection for more information on the lock information character.
- The FD column is parsable as a single field.
- TYPE
- is the type of the node associated with the file - e.g., GDIR, GREG,VDIR, VREG, etc.
- or ``IPv4'' for an IP version 4 socket;
- or ``IPv6'' for an IP version 6 socket;
- or ``ax25'' for a Linux AX.25 socket;
- or ``dnet'' for a DECnet socket;
- or ``inet'' for an Internet domain socket;
- or ``lla'' for a HP-UX link level access file;
- or ``rte'' for an AF_ROUTE socket;
- or ``sock'' for a socket of unknown domain;
- or ``unix'' for a UNIX domain socket;
- or ``x.25'' for an HP-UX x.25 socket;
- or ``BLK'' for a block special file;
- or ``CHR'' for a character special file;
- or ``DIR'' for a directory;
- or ``DOOR'' for a VDOOR file;
- or ``FIFO'' for a FIFO special file;
- or ``LINK'' for a symbolic link file;
- or ``MPB'' for a multiplexed block file;
- or ``MPC'' for a multiplexed character file;
- or ``PAS'' for a/proc/asfile;
- or ``PAXV'' for a/proc/auxvfile;
- or ``PCRE'' for a/proc/credfile;
- or ``PCTL'' for a/proccontrol file;
- or ``PCUR'' for the current/procprocess;
- or ``PCWD'' for a/proccurrent working directory;
- or ``PDIR'' for a/procdirectory;
- or ``PETY'' for a/procexecutable type (etype);
- or ``PFD'' for a/procfile descriptor;
- or ``PFDR'' for a/procfile descriptor directory;
- or ``PFIL'' for an executable/procfile;
- or ``PFPR'' for a/procFP register set;
- or ``PGD'' for a/proc/pagedatafile;
- or ``PGRP'' for a/procgroup notifier file;
- or ``PIPE'' for pipes;
- or ``PLC'' for a/proc/lwpctlfile;
- or ``PLDR'' for a/proc/lpwdirectory;
- or ``PLDT'' for a/proc/ldtfile;
- or ``PLPI'' for a/proc/lpsinfofile;
- or ``PLST'' for a/proc/lstatusfile;
- or ``PLU'' for a/proc/lusagefile;
- or ``PLWG'' for a/proc/gwindowsfile;
- or ``PLWI'' for a/proc/lwpsinfofile;
- or ``PLWS'' for a/proc/lwpstatusfile;
- or ``PLWU'' for a/proc/lwpusagefile;
- or ``PLWX'' for a/proc/xregsfile'
- or ``PMAP'' for a/procmap file (map);
- or ``PMEM'' for a/procmemory image file;
- or ``PNTF'' for a/procprocess notifier file;
- or ``POBJ'' for a/proc/objectfile;
- or ``PODR'' for a/proc/objectdirectory;
- or ``POLP'' for an old format/proclight weight process file;
- or ``POPF'' for an old format/procPID file;
- or ``POPG'' for an old format/procpage data file;
- or ``PORT'' for an Ultrix SYSV named pipe;
- or ``PREG'' for a/procregister file;
- or ``PRMP'' for a/proc/rmapfile;
- or ``PRTD'' for a/procroot directory;
- or ``PSGA'' for a/proc/sigactfile;
- or ``PSIN'' for a/proc/psinfofile;
- or ``PSTA'' for a/procstatus file;
- or ``PUSG'' for a/proc/usagefile;
- or ``PW'' for a/proc/watchfile;
- or ``PXMP'' for a/proc/xmapfile;
- or ``REG'' for a regular file;
- or ``SMT'' for a shared memory transport file;
- or ``UNNM'' for an unnamed type file.
- FILE-ADDR
- contains the kernel file structure address whenfhas been specified to+f;
- FCT
- contains the shared use count from the kernel file structure whenchas been specified to+f;
- FILE-FLAG
- whengorGhas been specified to+f,this field contains the contents of the f_flag[s] member of the kernelfile structure and the kernel's per-process open file flags (if available);`G' causes them to be displayed in hexadecimal;`g', as short-hand names;two lists may be displayed with entries separated by commas, thelists separated by a semicolon (`;');the first list may contain short-hand names for f_flag[s] values fromthe following table:
AIO asynchronous I/O (e.g., FAIO) AP append ASYN asynchronous I/O (e.g., FASYNC) BAS block, test, and set in use BKIU block if in use BL use block offsets BSK block seek CA copy avoid CLON clone CLRD CL read CR create DF defer DFI defer IND DFLU data flush DIR direct DLY delay DOCL do clone DSYN data-only integrity EX open for exec EXCL exclusive open FSYN synchronous writes GCDF defer during unp_gc() (AIX) GCMK mark during unp_gc() (AIX) GTTY accessed via /dev/tty HUP HUP in progress KERN kernel KIOC kernel-issued ioctl LCK has lock LG large file MBLK stream message block MK mark MNT mount MSYN multiplex synchronization NB non-blocking I/O NBDR no BDRM check NBIO SYSV non-blocking I/O NBF n-buffering in effect NC no cache ND no delay NDSY no data synchronization NET network NMFS NM file system NOTO disable background stop NSH no share NTTY no controlling TTY OLRM OLR mirror PAIO POSIX asynchronous I/O PP POSIX pipe R read RAIO Reliant UNIX RAIO request RC file and record locking cache REV revoked RSH shared read RSYN read synchronization SL shared lock SOCK socket SQSH Sequent shared set on open SQSV Sequent SVM set on open SQR Sequent set repair on open SQS1 Sequent full shared open SQS2 Sequent partial shared open STPI stop I/O SWR synchronus read SYN file integrity while writing TCPM avoid TCP collision TR truncate W write WKUP parallel I/O synchronization WTG parallel I/O synchronization VH vhangup pending VTXT virtual text XL exclusive lock - this list of names was derived from F* #define's in dialect header files<fcntl.h>, <linux</fs.h>, sys/fcntl.c>, <sys/fcntlcom.h>, and <sys/file.h>;see the lsof.h header file for a list showing the correspondencebetween the above short-hand names and the header file definitions;
- the second list (after the semicolon) may contain short-hand namesfor kernel per-process open file flags from this table:
ALLC allocated BR the file has been read BHUP activity stopped by SIGHUP BW the file has been written CLSG closing CX close-on-exec (see fcntl(F_SETFD)) MP memory-mapped LCK lock was applied RSVW reserved wait SHMT UF_FSHMAT set (AIX) USE in use (multi-threaded) - NODE-ID
- (or INODE-ADDR for some dialects)contains a unique identifier for the file node (usually the kernelvnode or inode address, but also occasionally a concatenation ofdevice and node number) whennhas been specified to+f;
- DEVICE
- contains the device numbers, separated by commas, for a character special,block special, regular, directory or NFS file;
- or the protocol control block address of a DECnet (Ultrix 4.2),Internet, UNIX, or x.25 (HP-UX) network file - the addressthat appears in the-Aoutput from somenetstat(1)programs;
- or ``memory'' for a memory file system node under DEC OSF/1, DigitalUNIX, or Tru64 UNIX;
- or the address of the private data area of a Solaris socketstream;
- or a kernel reference address that identifies the file(The kernel reference address may be used for FIFO's, for example.);
- orthe base address or device name of a Linux AX.25 socket device.
- Usually only the lower thirty two bits of DEC OSF/1, Digital UNIX,or Tru64 UNIX kernel addresses are displayed.
- SIZE, SIZE/OFF, or OFFSET
- is the size of the file or the file offset in bytes.A value is displayed in this column only if it is available.Lsofdisplays whatever value - size or offset - is appropriate for the typeof the file and the version oflsof.
- The file size is displayed in decimal;the offset is normally displayed in decimal with a leading ``0t'' ifit contains 8 digits or less; in hexadecimal with a leading ``0x'' ifit is longer than 8 digits.(Consult the-o ooption description for information on when 8 might default tosome other value.)
- Thus the leading ``0t'' and ``0x'' identify an offset when the columnmay contain both a size and an offset (i.e., its title is SIZE/OFF).
- If the-ooption is specified,lsofalways displays the file offset (or nothing if no offset is available)and labels the column OFFSET.The offset always begins with ``0t'' or ``0x'' as described above.
- Thelsofuser can control the switch from ``0t'' to ``0x'' with the-o ooption.Consult its description for more information.
- If the-soption is specified,lsofalways displays the file size (or nothing if no size is available)and labels the column SIZE.The-oand-soptions are mutually exclusive; they can't both be specified.
- For files that don't have a fixed size - e.g., don't resideon a disk device -lsofwill display appropriate information about the current size orposition of the file if it is available in the kernel structuresthat define the file.
- NODE
- is the node number of a local file;
- or the inode number of an NFS file in the server host;
- or the Internet protocol type - e. g, ``TCP'';
- or ``STR'' for a stream;
- or ``CCITT'' for an HP-UX x.25 socket;
- or the IRQ or inode number of a Linux AX.25 socket device.
- NAME
- is the name of the mount point and file system on which the file resides;
- or the name of a file specified in thenamesoption (after any symbolic links have been resolved);
- or the name of a character special or block special device;
- or the local and remote Internet addresses of a network file (as numbersor names, depending on the-nand-Poptions);a UDP destination Internet address may be followed by the amount of timeelapsed since the last packet was sent to the destination;TCP and UDP destination Internet addresses may be followed by TCP/TPIinformation in parentheses - state (e.g., ``(ESTABLISHED)'',``(SS_ISCONNECTED)'', ``(TS_IDLE)'', ``(Unbound)''), queue sizes, andwindow sizes (Solaris only) - in a fashionsimilar to whatnetstat(1)reports;see the-Toption description or the description of the TCP/TPI field inOUTPUT FOR OTHER PROGRAMSfor more information on state, queue size, and window size;
- or the local and remote node and object addresses of a DECnetfile (The node address appears as anarea.nodenumber pair if the-noption is specified.);
- or the address or name of a UNIX domain socket, possibly includinga stream clone device name, a file system object's path name, localand foreign kernel addresses, socket pair information, and a boundvnode address;
- or the local and remote mount point names of an NFS file;
- or ``STR'', followed by the stream name;
- or a stream character device name, followed by ``->'' and the stream name;
- or ``STR:'' followed by the SCO OpenServer stream device and modulenames, separated by ``->'';
- or the SunOS current working or root directory path name;
- or system directory name, `` -- '', and as many components of the pathname aslsofcan find in the kernel's name cache for selected dialects(See theKERNEL NAME CACHEsection for more information.);
- or ``PIPE->'', followed by a Solaris kernel pipe destination address;
- or ``COMMON:'', followed by the vnode device information structure'sdevice name, for a Solaris common vnode;
- or the address family, followed by a slash (`/'), followed by fourteencomma-separated bytes of a non-Internet raw socket address;
- or the HP-UX x.25 local address, followed by the virtual connectionnumber (if any), followed by the remote address (if any);
- or ``(dead)'' for disassociated DEC OSF/1, Digital UNIX, or Tru64 UNIXfiles - typically terminal files that have been flagged with the TIOCNOTTYioctl and closed by daemons;
- or ``rd=<offset>'' and ``wr=<offset>'' for the values of theread and write offsets of a FIFO;
- or ``clone n:/dev/event'' for SCO OpenServer file clones of the/dev/eventdevice, wherenis the minor device number of the file;
- or ``(socketpair: n)'' for a Solaris 2.6 or 7 UNIX domain socket,created by thesocketpair(3N)network function;
- or the local and remote addresses of a Linux IPX socket filein the form <net>:[<node>:]<port>, followed in parenthesesby the transmit and receive queue sizes, and the connection state.
For dialects that support a ``namefs'' file system, allowing onefile to be attached to another withfattach(3C),lsofwill add ``(FA:<address1><direction><address2>)'' to the NAME column.<address1> and <address2> are hexadecimal vnode addresses.<direction> will be ``<-'' if <address2> has been fattach'ed tothis vnode whose address is <address1>;and ``->'' if <address1>, the vnode address of this vnode, has beenfattach'ed to <address2>.<address1> may be omitted if it already appears in the DEVICE column. LOCKSLsofcan't adequately report the wide variety of UNIX dialect file locksin a single character.What it reports in a single character is a compromise between theinformation it finds in the kernel and the limitations of the reportingformat. Moreover, when |
|
|
