1.概述
lsof用于显示打开的文件。list open files。
2.各参数含义
a.-c列出指定进程所打开的文件
1
2
3
4
5
6
7
8
| [root@smart Desktop]# lsof -c Xorg
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
Xorg 2846 root cwd DIR 253,0 4096 653625 /var/gdm
Xorg 2846 root rtd DIR 253,0 4096 2 /
Xorg 2846 root txt REG 253,0 2295880 956717 /usr/bin/Xorg
Xorg 2846 root mem REG 253,0 122232 787409 /lib/libgcc_s-4.4.7-20120601.so.1
Xorg 2846 root mem REG 253,0 122864 949734 /usr/lib/libEGL.so.1.0.0
Xorg 2846 root mem REG 253,0 205188 949736 /usr/lib/libglamor.so.0.0.0
|
b.+d 列出目录下被打开的文件
1
2
3
4
5
6
7
8
| [root@smart Desktop]# lsof +d /root
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
gnome-ses 3056 root cwd DIR 253,0 4096 260610 /root
metacity 3162 root cwd DIR 253,0 4096 260610 /root
gnome-pan 3168 root cwd DIR 253,0 4096 260610 /root
nautilus 3174 root cwd DIR 253,0 4096 260610 /root
vmtoolsd 3200 root cwd DIR 253,0 4096 260610 /root
gpk-updat 3201 root cwd DIR 253,0 4096 260610 /root
|
c. +D 递归列出目录下被打开的文件
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
| [root@smart Desktop]# lsof +D /root
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
gnome-ses 3056 root cwd DIR 253,0 4096 260610 /root
metacity 3162 root cwd DIR 253,0 4096 260610 /root
metacity 3162 root 20w REG 253,0 16384 279738 /root/.cache/event-sound-cache.tdb.e321b5cbc96c34226a8725e100000034.i386-redhat-linux-gnu
gnome-pan 3168 root cwd DIR 253,0 4096 260610 /root
nautilus 3174 root cwd DIR 253,0 4096 260610 /root
nautilus 3174 root mem REG 253,0 32768 281492 /root/.local/share/gvfs-metadata/root-ecaddb60.log
nautilus 3174 root mem REG 253,0 1308 279766 /root/.local/share/gvfs-metadata/root
nautilus 3174 root mem REG 253,0 32768 279730 /root/.local/share/gvfs-metadata/label-CentOS_6.5_Final-0d9eaed7.log
nautilus 3174 root mem REG 253,0 184 279705 /root/.local/share/gvfs-metadata/label-CentOS_6.5_Final
nautilus 3174 root 31r REG 253,0 184 279705 /root/.local/share/gvfs-metadata/label-CentOS_6.5_Final
nautilus 3174 root 32r REG 253,0 32768 279730 /root/.local/share/gvfs-metadata/label-CentOS_6.5_Final-0d9eaed7.log
nautilus 3174 root 33r REG 253,0 1308 279766 /root/.local/share/gvfs-metadata/root
nautilus 3174 root 34r REG 253,0 32768 281492 /root/.local/share/gvfs-metadata/root-ecaddb60.log
vmtoolsd 3200 root cwd DIR 253,0 4096 260610 /root
|
d. -i <条件> 列出符合条件的进程。
条件包括：4/6、协议、：端口、@ip
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
| [root@smart Desktop]# lsof -i tcp
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
rpcbind 2027 rpc 8u IPv4 12996 0t0 TCP *:sunrpc (LISTEN)
rpcbind 2027 rpc 11u IPv6 13001 0t0 TCP *:sunrpc (LISTEN)
rpc.statd 2176 rpcuser 9u IPv4 13442 0t0 TCP *:35471 (LISTEN)
rpc.statd 2176 rpcuser 11u IPv6 13450 0t0 TCP *:41171 (LISTEN)
cupsd 2207 root 7u IPv6 13632 0t0 TCP localhost:ipp (LISTEN)
cupsd 2207 root 8u IPv4 13633 0t0 TCP localhost:ipp (LISTEN)
sshd 2378 root 3u IPv4 14309 0t0 TCP *:ssh (LISTEN)
sshd 2378 root 4u IPv6 14313 0t0 TCP *:ssh (LISTEN)
master 2612 root 12u IPv4 14799 0t0 TCP localhost:smtp (LISTEN)
master 2612 root 13u IPv6 14801 0t0 TCP localhost:smtp (LISTEN)
dnsmasq 2836 nobody 6u IPv4 16052 0t0 TCP 192.168.122.1:domain (LISTEN)
[root@smart Desktop]# lsof -i 4
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
rpcbind 2027 rpc 6u IPv4 12993 0t0 UDP *:sunrpc
rpcbind 2027 rpc 7u IPv4 12995 0t0 UDP *:930
rpcbind 2027 rpc 8u IPv4 12996 0t0 TCP *:sunrpc (LISTEN)
rpc.statd 2176 rpcuser 5r IPv4 13434 0t0 UDP *:spmp
rpc.statd 2176 rpcuser 8u IPv4 13438 0t0 UDP *:60627
rpc.statd 2176 rpcuser 9u IPv4 13442 0t0 TCP *:35471 (LISTEN)
cupsd 2207 root 8u IPv4 13633 0t0 TCP localhost:ipp (LISTEN)
cupsd 2207 root 10u IPv4 13636 0t0 UDP *:ipp
sshd 2378 root 3u IPv4 14309 0t0 TCP *:ssh (LISTEN)
master 2612 root 12u IPv4 14799 0t0 TCP localhost:smtp (LISTEN)
dnsmasq 2836 nobody 5u IPv4 16048 0t0 UDP *:bootps
dnsmasq 2836 nobody 6u IPv4 16052 0t0 TCP 192.168.122.1:domain (LISTEN)
dnsmasq 2836 nobody 7u IPv4 16053 0t0 UDP 192.168.122.1:domain
[root@smart Desktop]# lsof -i :930
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
rpcbind 2027 rpc 7u IPv4 12995 0t0 UDP *:930
rpcbind 2027 rpc 10u IPv6 13000 0t0 UDP *:930
|
e.-p 列出进程所打开文件
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
| [root@smart Desktop]# lsof -p 1
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
init 1 root cwd DIR 253,0 4096 2 /
init 1 root rtd DIR 253,0 4096 2 /
init 1 root txt REG 253,0 149284 9657 /sbin/init
init 1 root mem REG 253,0 122232 787409 /lib/libgcc_s-4.4.7-20120601.so.1
init 1 root mem REG 253,0 1910572 787370 /lib/libc-2.12.so
init 1 root mem REG 253,0 133312 787374 /lib/libpthread-2.12.so
init 1 root mem REG 253,0 286396 787407 /lib/libdbus-1.so.3.4.0
init 1 root mem REG 253,0 58704 782877 /lib/libnss_files-2.12.so
init 1 root mem REG 253,0 142536 785996 /lib/ld-2.12.so
init 1 root mem REG 253,0 100500 783114 /lib/libnih.so.1.0.0
init 1 root mem REG 253,0 38768 783112 /lib/libnih-dbus.so.1.0.0
init 1 root mem REG 253,0 41724 787390 /lib/librt-2.12.so
init 1 root 0u CHR 1,3 0t0 3908 /dev/null
init 1 root 1u CHR 1,3 0t0 3908 /dev/null
init 1 root 2u CHR 1,3 0t0 3908 /dev/null
init 1 root 3r FIFO 0,8 0t0 8720 pipe
init 1 root 4w FIFO 0,8 0t0 8720 pipe
init 1 root 5r DIR 0,10 0 1 inotify
init 1 root 6r DIR 0,10 0 1 inotify
init 1 root 7u unix 0xc16facc0 0t0 8721 socket
init 1 root 9u unix 0xf4abd980 0t0 13185 socket
|
