LSOF(8) System Manager's Manual LSOF(8) (NAME) lsof - (SYNOPSIS) lsof [ -?abChHlnNOPQRtUvVX ] [ -A A ] [ -c c ] [ +c c ] [ +|-d d ] [ +|-D D ] [ +|-e s ] [ +|-E ] [ +|-f [cfgGn] ] [ -F [f] ] [ -g [s] ] [ -i [i] ] [ -k k ] [ -K k ] [ +|-L [l] ] [ +|-m m ] [ +|-M ] [ -o [o] ] [ -p s ] [ +|-r [t[m]] ] [ -s [p:s] ] [ -S [t] ] [ -T [t] ] [ -u s ] [ +|-w ] [ -x [fl] ] [ -z [z] ] [ -Z [Z] ] [ -- ] [names] (DESCRIPTION) Lsof 4.99.7 (UNIX dialects) : Apple Darwin 9, Mac OS X 10, macOS 11 and above FreeBSD 8.2 and above Linux 2.1.72 and above NetBSD 1.2 and above OpenBSD 7.2 and above Solaris 9, 10 and 11 and above OpenIndiana 5.11 and above ( lsof DISTRIBUTION .) (block special file) (character special file) (executing text reference) (stream) ( NFS ) . . lsof . -F OUTPUT FOR OTHER PROGRAMS . lsof (repeat mode) . (interrupt) (quit) . +|-r [t[m]] . (OPTIONS) lsof . - -U NFS -N -u -U . OR () - -i -ufoo <> . : 1) (UID) <<^>> -u 2) (PID) <<^>> -p 3) (PGID) <<^>> -g 4) <<^>> -c 5) TCP UDP (<<^>>) -s [p:s] . () OR AND . -a AND ( ) . -a -U -ufoo <> . : -a AND AND . -a AND . - (file descriptors) (zone names) (security contexts) - OR AND . -i@aaa.bbb -i@ccc.ddd -a -ufff,ggg <> <> aaa.bbb ccc.ddd . -- <<-a -b -C>> -abC . +|-f -F -g -i +|-L -o +|-r -s -S -T -x -z . -Fn -F -n n -F . <<->> - <<-F -n>>. <<-->> - <<-F -- name>>. <<+>> <<->> . - -i - . <<+M -i>> <<+Mi>> . - +|-M - <<-iM>> <<-i +M>> . . -? -h (usage) . Lsof . ( <> .) -a AND . -A A AFS AFS . lsof A (name list file) . lsof FAQ lsof ( FAQ ) . -b lsof (blocking) - lstat(2) readlink(2) stat(2). BLOCKS AND TIMEOUTS AVOIDING KERNEL BLOCKS . -c c c . -c . AND OR . c <<^>> ( ). c ('/') (regular expression) . (shell meta-characters) . : b (basic) . i . x (extended) (). FAQ lsof ( FAQ ) . . . . -V lsof <> . +c w COMMAND . ( lsof .) lsof lsof . . 2.4.27 9 . w ('0') lsof . w "COMMAND" . -C (kernel's name cache) . KERNEL NAME CACHE . +d s lsof s . +d s ( ). +D D D . +d s -x -x l . s -x -x f . : stat(2) . -d s (FD) . s - "cwd,1,3" "^6,^2". ( .) `^` (exclusion) . `^` (inclusion) . . - "0-7" "3-10". `^` - "^0-7" 0 7 . AND OR . lsof . (FD) OUTPUT . fd . fd FD . +D D lsof D . +D D -x -x l . D -x -x f . : stat(2) . : lsof . D stat(2) . D . -D D lsof (device cache file) . . DEVICE CACHE FILE . -D (function letter) . Lsof : ? - b - i - r - u - b r u . -D -h -? . DEVICE CACHE FILE . ? lsof lsof . ( `?` .) b r u . .lsof_hostname lsof lsof . ( -h -? - ".lsof".) hostname gethostname(2) . b lsof . i lsof . r lsof . r lsof . r lsof . u lsof . -D . +|-e s s (blocking) . +e stat(2) lstat(2) readlink(2) . -e stat(2) lstat(2) . +|-e readlink(2) . . : inode . ( inode stat(2) +|-m m .) . . "UNKN" TYPE NAME . ( +|-m m .) +|-E +E pipe UNIX socket INET(6) socket pseudoterminal POSIX Message Queue eventfd (endpoint) . : UNIX socket -v uxsockept pseudoterminal ptyept . : POSIX Message Queue mqueue (mount) . pipe NAME "PID,cmd,FDmode" PID cmd FD mode . Pseudoterminal NAME "->/dev/ptsmin PID,cmd,FDmode" "PID,cmd,FDmode" . master slave . min (minor device number) slave PID, cmd, FD mode pipe . : pseudoterminal -v ptyept . 4.13.0 . UNIX socket NAME "type=TYPE ->INO=INODE PID,cmd,FDmode" TYPE INODE i- node PID, cmd, FD mode pipe . : UNIX socket -v uxsockept . (endpoint) INET NAME `` -> PID,cmd,FDmode'' PID, cmd, FD mode . IPC IPv4 IPv6 (bind) . POSIX NAME . eventfd NAME . 5.2.0 . NAME . -E . +|-f [cfgGn] f . c f g G n (`+') (`-'). mount(8) mount . +f lsof . ( ) . CD-ROM . -f . ``-f -- /'' lsof `/' `/' (). +f -f ( ) . +f -f ``--'' . $ lsof +f -- /file/system/name $ lsof -f -- /file/name +f [cfgGn] - /proc 2.6.22. f (`+') : c ( ) f ( ) g ( 2.6.22 ) Abbrev. Flag in C code (see open(2)) W O_WRONLY RW O_RDWR CR O_CREAT EXCL O_EXCL NTTY O_NOCTTY TR O_TRUNC AP O_APPEND ND O_NDELAY SYN O_SYNC ASYN O_ASYNC DIR O_DIRECT DTY O_DIRECTORY NFLK O_NOFOLLOW NATM O_NOATIME DSYN O_DSYNC RSYN O_RSYNC LG O_LARGEFILE CX O_CLOEXEC TMPF O_TMPFILE G ( 2.6.22 ) n ( ) (`-') . . lsof lsof AWK Perl C . -F f f . f . NL NUL (000) . OUTPUT FOR OTHER PROGRAMS . ( ) NL . (`0') ( ) NUL . f OUTPUT FOR OTHER PROGRAMS . lsof - PPID -R - - ``-FR'' - . `?' lsof . ( `?' /escape .) -g [s] (PGID) s - ``123'' ``123,^456''. ( .) PGID `^' () . PGID AND OR . PGID OR AND . -g PGID . PGID . -H lsof 123.4K 456.7M. -J JSON . -F lsof JSON processes . files . -F : -F JSON . -F . -J -j -t . stderr JSON ( ). -j JSON Lines . JSON . (Splunk Datadog Elastic) . -J . -j -J -t . : JSON (RFC 8259) UTF-8 . UTF-8 . lsof . JSON . lsfd(1) ip(8) (-j) JSON . RFC 8259 ( iconv(1) surrogateescape ). -i [i] i . x.25 ( HP-UX) . -i4 -i6 IP IPv4 IPv6 . ( IPv6 IPv6 ``[46]'' ``IPv[46]'' -h -? lsof .) -i4 -i6 -i . -i4 -i6 -i -i4 -i6 . ( ) -i . ( .) AND OR . ( ): [46][protocol][@hostname|hostaddr][:service|port] : 46 IP (IPv4 IPv6) . '6' IPv6 . '4' '6' IP . protocol - TCP UDP UDPLITE. hostname . IP . hostaddr IPv4 IPv6 IPv6 . IP . service /etc/services - smtp - . port . IPv6 IPv6 . IPv6 lsof -h -? () . -i <<[46]>> <> IPv6 . -i 6 IPv6 IPv4 . -i 4 IPv4 IPv6 . IPv4 IPv6 IPv6 IPv4 <<6>> <<4>>. - 4 6 protocol hostname hostaddr service - . <<@>> <<:>> . hostname hostaddr . service port . service TCP UDP UDPLITE protocol . protocol - - . Service port . protocol . . : -i6 - IPv6 TCP:25 - TCP 25 @1.2.3.4 - IPv4 1.2.3.4 @[3ffe:1ebc::1]:1234 - IPv6 3ffe:1ebc::1 1234 UDP:who - who UDP TCP@lsof.itap:513 - TCP 513 lsof.itap tcp@foo:1-10,smtp,99 - TCP 1 10 smtp 99 foo tcp@bar:1-smtp - TCP 1 smtp bar :time - TCP UDP UDPLITE -K k () () . ( - -h -? - () .) -K k <> . lsof . -K -a . ( TID OUTPUT .) FreeBSD (ID) . lsof . -k k k /vmunix /mach . -k AIX IBM RISC/System 6000 . -l . . +|-L [l] (link count) (<<+>>) (<<->>) - FIFO pipe . +L . -L ( ) . +L . ( -L .) <<+L1>> (unlinked). <<+aL1 >> (unlinked) . (-F) . +|-m m (mount) . -m m m /dev/kmem /dev/mem - crash dump. +m mount . . mount <<0x>> - : / 0x801 Lsof mount stat(2) lstat(2) . +m m m mount . : +m +m m . -h -? lsof +m +m m . +|-M portmapper TCP UDP UDPLITE (+) (-) . ( portmapper .) lsof HASPMAPENABLED #define machine.h lsof HASPMAPENABLED portmapper +M . -h -? lsof . portmapper . portmapper lsof portmapper ( ) TCP UDP UDPLITE - <<:1234[name]>> <<:name[100083]>>. portmapper . portmapper portmapper lsof . portmapper lsof . portmapper lsof TCP UDP UDPLITE : (foreign) INADDR_LOOPBACK (127.0.0.1) . lsof . portmapper lsof ( FAQ ) . portmapper RPC . ( GlibC 2.14 .) portmapper -h -? +|-M . -n . lsof . . -N NFS . -o lsof (file offset) . SIZE/OFF OFFSET . : lsof ( ) . lsof ( FAQ ) . -o -s . lsof - - . -o o (o) <<0t>> <<0x...>> . () o lsof <<0t>> . lsof -o ( ) . -o o <<0t>> . lsof : -o -o 10 -oo10 "0t" 8 lsof . -o o -h -? . -O lsof - (forked) - . lsof BLOCKS AND TIMEOUTS AVOIDING KERNEL BLOCKS . lsof (hang) lsof . . -p s (PID) s - "123" "123,^456". ( .) PID `^` () . AND OR . PID OR AND . -P ( /etc/services ). lsof . . -Q . lsof PID PID lsof . -Q lsof (0) . stderr . +|-r [t[c][m]] lsof . lsof t ( ) . `-` . Lsof (interrupt) (quit) . `c` `` Lsof . `+` - lsof . . Lsof : ( -F ) `m` "========" . NL ( ) . "m" . `m` strftime(3) localtime(3) C . strftime(3) . -F "%n" . . lsof lsof . +|-r lsof lsof . - -c -g -p -u - . ( -F ) awk Perl C . -R lsof (PPID) PPID . -s [p:s] s lsof . SIZE/OFF SIZE . . -s p:s -h -? . s (p) TCP UDP (`:`) TCP UDP (s) `^` `^` . . . lsof . . (`:`) (p) (s) . TCP UDP -i . -i . TCP LISTEN : -iTCP -sTCP:LISTEN UDP Idle : -iUDP -sUDP:^Idle . TCP : CLOSED IDLE BOUND LISTEN ESTABLISHED SYN_SENT SYN_RCDV ESTABLISHED CLOSE_WAIT FIN_WAIT1 CLOSING LAST_ACK FIN_WAIT_2 TIME_WAIT. UDP Unbound Idle. Apple Darwin UDP lsof . (FAQ) lsof ( FAQ ) . -o ( ) -s ( ) . lsof - - . - FIFO (pipes) - lsof . -S [t] (time-out) - lstat(2) readlink(2) stat(2) - (deadlock) . t . BLOCKS AND TIMEOUTS . -T [t] TCP/TPI netstat(1) . TCP TPI `=' : QR= QS= SO= SS= TF= WR= WW= . ( ) '=' . ( OUTPUT FOR OTHER PROGRAMS ) `T' . -T TCP/TPI . -T TCP/TPI : f TCP . q . s . w . . (state) . -h -? -T . -T - - -T . ( -Ts .) -Tqs . TCP TCP ( ) SO_ so_ SS_ TCP_ TF_ - . . "SO=" "SS=" "TF=" TCP . '=' -- "SO=LINGER=5" "SO=QLIM=5" "TF=MSS=512". : Name Reported Description (Common Symbol) KEEPALIVE keep alive time (SO_KEEPALIVE) LINGER linger time (SO_LINGER) MSS maximum segment size (TCP_MAXSEG) PQLEN partial listen queue connections QLEN established listen queue connections QLIM established listen queue limit RCVBUF receive buffer length (SO_RCVBUF) SNDBUF send buffer length (SO_SNDBUF) TCP "Why doesn't lsof report socket options, socket states, and TCP flags and values for my dialect?" "Why doesn't lsof report the partial listen queue connection count for my dialect?" lsof FAQ ( FAQ ). (UNIX domain sockets) . -t (PID ) : # reload anything using old SSL lsof -t /lib/*/libssl.so.* | xargs -r kill -HUP # get list of processes and then iterate over them (Bash only) mapfile -t pids < <( lsof -wt /var/log/your.log ) for pid in "${pids[@]}" ; do your_command -p "$pid" done -t -w . -u s (UID) s - "abe" "548,root". ( .) AND OR . `^' (negation) - . AND OR . lsof (root) "-u^root" "-u^0" . -U (UNIX domain socket files) . -v lsof : (revision number) lsof lsof lsof -a uname . -V lsof - NFS PID PGID UID. AND lsof AND . "lsof -V -iTCP@foobar -a -d 999" "TCP@foobar" 999 . HASSECURITY HASNOSOCKSECURITY . +|-w (+) (-) . lsof . -h -? . . -t -w . -x [fl] +d +D / (+d) (+D) . -x . -x '-' '+' . 'f' 'l' . -x +d +D . -X (dialect-specific) . AIX: IBM AIX RISC/System 6000 . : readx() AIX (kill). . readx() . AIX 5L lsof setuid-root . lsof -X UID (root) . -X -h -? UID lsof root . lsof UID -X . readx() AIX lsof text loader AIX Stale Segment ID . readx() lsof Stale Segment ID . dir_search() . lsof - open(2) - dir_search() . Stale Segment ID APAR readx() lsof lsof FAQ ( FAQ ) 00README lsof . Linux: lsof TCP UDP UDPLITE IPv4 IPv6 . TCP UDP UDPLITE /proc/net/tcp* /proc/net/udp* lsof . lsof TCP UDP UDPLITE . Solaris 10 and above: Solaris 10 (cached paths) - rm(1) unlink(2) - . " (deleted)" . - mv(1) rename(2) - lsof . -z [z] (zone) Solaris 10 . - z - ZONE . -z z . lsof . -z z . . -Z [Z] SELinux (security contexts) . 'Z' SELinux . 'Z' OUTPUT FOR OTHER PROGRAMS . - Z - SECURITY-CONTEXT . -Z (wildcard) Z . lsof . -Z Z . . Z A:B:C *:B:C A:B:* *:*:C A:B:C . -- . ( ) . . names . . "--" . name (mounted-on) lsof . name mount(8) . +|-f lsof name (+f) (-f) . name - (current working directory) . lsof +d s +D D . name (multiplexed files) - /dev/pt[cs] - AIX lsof - /dev/pt[cs]/1 /dev/pt[cs]/2 . name (UNIX domain socket) lsof - . ( .) - ./file - - /tmp/file - lsof . name lsof inode name . -- ('/') -- /proc/net/unix lsof (node) /proc/net/unix name stat(2) . lsof name . /dev/log lsof /dev name ./log . name lsof inode name . -b name mount . AVOIDING KERNEL BLOCKS ALTERNATE DEVICE NUMBERS . AND OR . AFS (AFS) lsof AFS ( AFS) : AIX 4.1.4 (AFS 3.4a) HP-UX 9.0.5 (AFS 3.4a) Linux 1.2.13 (AFS 3.3) Solaris 2.[56] (AFS 3.4a) AFS . AFS lsof AFS AFS . lsof AFS AFS . lsof AFS (volume) AFS . lsof NODE . -A A lsof (name list) . lsof -h -? . lsof FAQ lsof ( FAQ ) . AFS (name cache) lsof AFS . (SECURITY) lsof . . (device cache) lsof . ( lsof .) -k -m . HASSECURITY HASNOSOCKSECURITY . HASSECURITY lsof root . root lsof ( ) . HASSECURITY HASNOSOCKSECURITY -i . HASSECURITY . -h -? HASSECURITY HASNOSOCKSECURITY . lsof HASSECURITY HASNOSOCKSECURITY Security 00README lsof . HASDCACHE . DEVICE CACHE FILE . lsof lsof root root - / /root. HASDCACHE lsof . HASDCACHE lsof -h -D? -? . HASDCACHE -h -? -D . - /dev ( /devices) lsof - 00DCACHE lsof FAQ lsof ( FAQ ) . -Di . lsof -k -m lsof access(2) . lsof . (OUTPUT) lsof . OUTPUT FOR OTHER PROGRAMS . lsof ( isprint(3) ) . : C <<\[bfrnt]>> <<^>> ( <<^@>>) <<\x>> ( <<\xab>>). COMMAND (<<\x20>>) . - HASSETLOCALE machine.h - lsof . lsof ( LANG) isprint(3) . lsof . LANG ( LC_ALL LC_CTYPE ) setlocale(3) . lsof ( UTF-8) - HASSETLOCALE HASWIDECHAR machine.h lsof . iswprint(3) . HASSETLOCALE HASWIDECHAR iswprint(3) lsof . "Language locale support" FAQ lsof ( FAQ ). lsof . . COMMAND . w +c w w lsof . ( +c w FAQ lsof . FAQ .) w "COMMAND" . w +c w . ('c') . OUTPUT FOR OTHER COMMANDS . PID (Process IDentification number) . TID (Thread/Task IDentification number) () () . ( - -h -? - () .) TID - (non-task). TASKCMD . COMMAND ( ) . TASKCMD COMMAND . ZONE (Zone) . -z . SECURITY-CONTEXT SELinux (SELinux security context) . -Z . SELinux -Z . PPID (Parent Process IDentification number) . -R . PGID (Process Group IDentification number) . -g . USER (login name) ps(1) . USER /proc lsof . ps(1) (effective user ID) . ( -l .) FD (File Descriptor) : cwd Lnn (AIX) ctty (character tty) DEL err FD ( NAME ) fp. (Darwin) jld (FreeBSD) ltx ( ) Mxx xx m86 DOS Merge mem mmap NOFD /proc//fd -- NAME pd Rnn pregion (HP-UX) rtd twd txt ( ) v86 VP/ix FD : r w u (space) `-' . : N NFS r R w W u U x SCO OpenServer Xenix X SCO OpenServer Xenix (space) . LOCKS . FD . FD "*" "*001" . TYPE (Node) - VDIR VREG "ax25" AX.25 "a_inode" inode (anonymous inode) "icmp" ICMP "inet" (Internet domain socket) "ipx" IPX "key" "lla" HP-UX "ndrv" (net driver) "netlink" netlink "pack" (packet socket) "ppp" PPP "raw" (raw socket) "raw6" IPv6 "rte" AF_ROUTE "sock" "systm" "unix" (UNIX domain socket) "x.25" x.25 HP-UX "ATALK" AppleTalk "BLK" (block special file) "CHR" (character special file) "DEL" "DIR" "DOOR" VDOOR "EVENTFD" eventfd "FIFO" FIFO "FSEVENTS" fsevents "IPv4" IPv4 "IPv6" IPv6 - IPv4 IPv6 "KQUEUE" BSD "LINK" "MPB" (multiplexed block file) "MPC" (multiplexed character file) "PAS" /proc/as "PAXV" /proc/auxv "PCRE" /proc/cred "PCTL" /proc "PCUR" /proc "PCWD" /proc "PDIR" /proc "PETY" /proc (etype) "PFD" /proc "PFDR" /proc "PFIL" /proc "PFPR" (FP register set) /proc "PGD" /proc/pagedata "PGID" /proc "PIPE" (pipes) "PLC" /proc/lwpctl "PLDR" /proc/lpw "PLDT" /proc/ldt "PLPI" /proc/lpsinfo "PLST" /proc/lstatus "PLU" /proc/lusage "PLWG" /proc/gwindows "PLWI" /proc/lwpsinfo "PLWS" /proc/lwpstatus "PLWU" /proc/lwpusage <> /proc/xregs <> /proc (map) <> /proc/maps <> /proc <> /proc <> /proc/object <> /proc/object <> /proc <> PID /proc <> /proc <> SYSV <> /proc <> /proc/rmap <> <> /proc <> /proc/sigact <> /proc/psinfo <> /proc <> POSIX <> POSIX <> POSIX <> /dev/pts <> /proc/usage <> /proc/watch <> /proc/xmap <> <> <> <> streams <> stream <> <> <> <> <> <> <> <> <> OpenServer Xenix <> OpenServer Xenix <> OpenServer Xenix <> Darwin <> () . FILE-ADDR f +f FCT c +f FILE-FLAG g G +f f_flag[s] ( ) `G' () `g' - (`;`) f_flag[s] : AIO asynchronous I/O (e.g., FAIO) AP append ASYN asynchronous I/O (e.g., FASYNC) BAS block, test, and set in use BKIU block if in use BL use block offsets BSK block seek CA copy avoid CIO concurrent I/O CLON clone CLRD CL read CR create DF defer DFI defer IND DFLU data flush DIR direct DLY delay DOCL do clone DSYN data-only integrity DTY must be a directory EVO event only EX open for exec EXCL exclusive open FSYN synchronous writes GCDF defer during unp_gc() (AIX) GCMK mark during unp_gc() (AIX) GTTY accessed via /dev/tty HUP HUP in progress KERN kernel KIOC kernel-issued ioctl LCK has lock LG large file MBLK stream message block MK mark MNT mount MSYN multiplex synchronization NATM don't update atime NB non-blocking I/O NBDR no BDRM check NBIO SYSV non-blocking I/O NBF n-buffering in effect NC no cache ND no delay NDSY no data synchronization NET network NFLK don't follow links NMFS NM file system NOTO disable background stop NSH no share NTTY no controlling TTY OLRM OLR mirror PAIO POSIX asynchronous I/O PATH path PP POSIX pipe R read RC file and record locking cache REV revoked RSH shared read RSYN read synchronization RW read and write access SL shared lock SNAP cooked snapshot SOCK socket SQSH Sequent shared set on open SQSV Sequent SVM set on open SQR Sequent set repair on open SQS1 Sequent full shared open SQS2 Sequent partial shared open STPI stop I/O SWR synchronous read SYN file integrity while writing TCPM avoid TCP collision TMPF temporary file TR truncate W write WKUP parallel I/O synchronization WTG parallel I/O synchronization VH vhangup pending VTXT virtual text XL exclusive lock #define *F common.h ( -) : ALLC allocated BR the file has been read BHUP activity stopped by SIGHUP BW the file has been written CLSG closing CX close-on-exec (see fcntl(F_SETFD)) LCK lock was applied MP memory-mapped OPIP open pending - in progress RSVW reserved wait SHMT UF_FSHMAT set (AIX) USE in use (multi-threaded) NODE-ID ( INODE-ADDR ) ( vnode inode ) n +f DEVICE NFS <> Tru64 UNIX stream Solaris ( FIFO ) AX.25 . Tru64 UNIX . SIZE SIZE/OFF OFFSET . . lsof lsof - - . lsof ( ). - FIFO - lsof ( TCP/IP). FAQ lsof ( FAQ ) . <<0t>> <<0x>> . ( -o o ). <<0t>> <<0x>> ( SIZE/OFF ) . -o lsof ( ) OFFSET . <<0t>> <<0x>> . lsof <<0t>> <<0x>> -o o . . -s lsof ( ) SIZE . -o -s . -H lsof . - - lsof . NLINK +L NODE inode NFS - <> <> <> HP-UX x.25 IRQ inode Linux AX.25. NAME (mount point) names ( ) IP (':') (port) <<->>> IP +|-M -n -P IPv6 INADDR_ANY IPv4 IN6_IS_ADDR_UNSPECIFIED IPv6 ('*') UDP TCP UDP UDPLITE TCP/TPI - ( <<(ESTABLISHED)>> <<(Unbound)>>) ( ) - netstat(1) -T TCP/TPI (OUTPUT FOR OTHER PROGRAMS) (UNIX domain socket) stream clone vnode (bound) NFS <> <<->>> <<->>> <> SCO OpenServer <<->>> << -- >> lsof (kernel's name cache) ( (KERNEL NAME CACHE) .) <>> (Solaris) <> vnode vnode Solaris (address family) (`/`) HP-UX x.25 ( ) ( ) <<(dead)>> (disassociated) Tru64 - ioctl TIOCNOTTY <>> <>> FIFO <> SCO OpenServer /dev/event n (minor device number) <<(socketpair: n)>> Solaris 2.6 8 9 10 socketpair(3N) <> (protocol block) <<, CANTSENDMORE>> <<, CANTRCVMORE>> ( shutdown(2)) Linux IPX :[:] <> <> UnixWare 7.1.1 (':') <<->>> (association value) (endpoint) Linux SCTP <> . <> fattach(3C) lsof <<(FA:)>> NAME . vnode . vnode (fattach) <<<->> ( vnode) <<->>> . DEVICE . Lsof Solaris 10 NAME : <<(?)>> lsof <<(deleted)>> -X lsof . NAME (FAQ) lsof ( FAQ ) . (LOCKS) Lsof . . (byte level) lsof . - 'r' 'w' 'x' - . lsof . ( NFS) . Solaris - 2.3 2.4 Solaris . Lsof . (BUGS) FAQ lsof ( FAQ ) . (OUTPUT FOR OTHER PROGRAMS) -F lsof - awk Perl C - . NL (012) ( 0 () NUL (000)) . . . 'p' ( (PID)) . PID . (PGID) () (TID) (UID) . 'f' ( file descriptor) . inode . . NUL (000) 0 () lsof NL (012) . Lsof : PID ('p'). ('m') . -F . lsof - PPID -R - - - <<-FR>> - . 4.88 4.93.2 lsof ('f'). lsof . PID . 'f' . - . lsof -F NL ( -F0 NUL ). -F -F0 (raw device) . lsof . . a (file access mode) c ( proc user) C (file structure share count) d D / (0x) f (file descriptor) F (0x) G (0x +fg ) g (process group ID) i inode K (tasK ID) k (link count) l L (login name) m ( ) M (task comMand name) n N (0x) o (0t 0x -o o ) p ( ) P r (0x) R (parent process ID) s () S t T TCP/TPI ( '=' ): QR= QS= SO= ( ) SS= ( ) ST= TF= ( ) WR= ( ) WW= ( ) ( TCP/TPI . -h -? -T TCP/TPI .) u (user ID) z (zone name) Solaris 10 Z SELinux ( SELinux ) 0 NUL NL 1-9 ( -F? .) -F? . ( '?' .) (OUTPUT) . <<-F pcfn>> ('p') ('c') ('f') ('n') NL <<-F pcfn0>> NUL (000) . Lsof . : / inode . . lsof NL (012) . 0 () NUL (000) . NUL xargs (1) . NUL lsof NL (012) . lsof lsof . C lsof_fields.h . lsof . awk Perl 4 Perl 5 . scripts lsof . C lsof . C lsof . tests/LTlib.c lsof . lsof_fields.h . (BLOCKS AND TIMEOUTS) lsof - lstat(2) readlink(2) stat(2). NFS . lsof . lsof . -t -w . -h -? -S [t] . t lsof . lsof . -O lsof . lsof lsof . . (AVOIDING KERNEL BLOCKS) -b lsof . . lsof lstat(2) stat(2) . ALTERNATE DEVICE NUMBERS . names lsof . lsof inode names lsof -b lsof . lsof . lsof . lsof lsof . -b lsof readlink(2) . -b lsof -b . -w . (ALTERNATE DEVICE NUMBERS) lsof lstat(2) stat(2) -b lsof - - . lsof . ( -w .) /etc/mtab /etc/mnttab "dev=xxxx" . : - /etc/mnttab Solaris /proc/mounts (read-only) . +m +m m . -h -? lsof +m +m m . "xxxx" . ( st_dev lstat(2) stat(2) .) /etc/mnttab Sun Solaris 2.6 NFS : nfs ignore,noquota,dev=2a40001 "dev=xxxx" NFS . lsof lsof lstat(2) stat(2) . NFS . /etc/mtab /etc/mnttab . AIX Apple Darwin FreeBSD NetBSD OpenBSD Tru64 UNIX . lsof lstat(2) stat(2) . lsof : lsof -b "assuming "dev=xxxx" from ..." . (KERNEL NAME CACHE) lsof AFS ( tag_to_path() ADVFS 4.x Tru64 UNIX) . ( AFS Solaris VxFS .) lsof NAME . lsof NAME `-' `/' . lsof - -r - . . lsof . (node) ( SCO OpenServer) . (unlinked) lsof . lsof ( FAQ ) . lsof : FreeBSD HP-UX Linux NetBSD SCO OpenServer SCO|Caldera UnixWare Solaris Tru64 UNIX lsof : AIX OpenBSD lsof lsof FAQ ( FAQ .) (DEVICE CACHE FILE) /dev ( /devices) stat(2) . lsof - inode - . lsof ASCII /dev ( /devices) (: lsof /proc .) lsof : -D () . -h -D? -? . lsof . -D? . Lsof (CRC) . lsof . lsof . lsof . -Dr . ( .) . lsof (mtime) mtime ctime /dev ( /devices) lsof . lsof UID 0600 . LSOF (LSOF PERMISSIONS THAT AFFECT DEVICE CACHE FILE ACCESS) lsof . lsof . setuid-root . lsof UID root UID ( ) root . lsof setuid-root : HP-UX 11.11 and 11.23 Linux setgid . (GID) lsof - "kmem" "sys" "system". lsof setgid () . lsof . lsof setgid setgid : AIX 5.[12] and 5.3-ML1 Apple Darwin 7.x Power Macintosh systems FreeBSD 4.x, 4.1x, 5.x and [6789].x for x86-based systems FreeBSD 5.x, [6789].x and 1[012].8for Alpha, AMD64 and Sparc64 based systems HP-UX 11.00 NetBSD 1.[456], 2.x and 3.x for Alpha, x86, and SPARC-based systems OpenBSD 2.[89] and 3.[0-9] for x86-based systems SCO OpenServer Release 5.0.6 for x86-based systems SCO|Caldera UnixWare 7.1.4 for x86-based systems Solaris 2.6, 8, 9 and 10 Tru64 UNIX 5.1 (: lsof AIX 5L -X setuid-root .) Lsof : Linux -D (DEVICE CACHE FILE PATH FROM THE -D OPTION) -D . ? lsof . b r u -D (b[path]) (r[path]) (u[path]) . b r u . lsof setuid-root . r . b r u lsof setgid lsof setgid . ( setgid LSOF PERMISSIONS THAT AFFECT DEVICE CACHE FILE ACCESS .) -D i ( ignore ) . b lsof stat(2) . r lsof . -Dr . r . lsof setuid-root setgid r . u lsof . UID lsof . (DEVICE CACHE PATH FROM AN ENVIRONMENT VARIABLE) lsof LSOFDEVCACHE . lsof setuid-root UID root . LSOFDEVCACHE : lsof setgid lsof . ( setgid LSOF PERMISSIONS THAT AFFECT DEVICE CACHE FILE ACCESS .) lsof LSOFDEVCACHE . -D? . (SYSTEM-WIDE DEVICE CACHE PATH) lsof . /dev ( /devices) . lsof . lsof - -h -? - . Lsof . -D root . 0644 ( ) . [] (PERSONAL DEVICE CACHE PATH (DEFAULT)) lsof UID lsof . .lsof_hostname . lsof . lsof lsof . lsof . hostname gethostname(2) . `.` gethostname(2) gethostname(2) `.` . (user ID) - 0600 . lsof . hostname NFS . lsof . -Dr . -D? (format specification) . 00DCACHE lsof . (MODIFIED PERSONAL DEVICE CACHE PATH) lsof LSOFPERSDCPATH . LSOFPERSDCPATH <<%p>> HASPERSDC machine.h . ( lsof .) LSOFPERSDCPATH <> <> <> HASPERSDC (<<%h/%p.lsof_%L>>) : /Homes/abe/LSOF/.lsof_vic LSOFPERSDCPATH lsof setuid-root (UID) root . Lsof lsof setgid . ( setgid LSOF PERMISSIONS THAT AFFECT DEVICE CACHE FILE ACCESS .) LSOFPERSDCPATH lsof setgid lsof . : lsof LSOFPERSDCPATH HASPERSDC . HASPERSDC -D? . (DIAGNOSTICS) (standard error) . Lsof NFS PIDs PGIDs UIDs (1) . -V lsof . -Q lsof . -Q (0) . lsof /dev ( /devices) stat(2) . lsof /dev ( /devices) - -h -? - : Inaccessible /dev warnings are enabled. -w (). lsof WARNDEVACCESS . : Inaccessible /dev warnings are disabled. lsof . (EXAMPLES) 00QUICKSTART lsof . : lsof x.25 (HP-UX) UNIX : lsof -i -U IPv4 PID 1234 : lsof -i 4 -a -p 1234 PID 1234 PID 1234 IPv4 -Q : lsof -Q -i 4 -a -p 1234 UNIX IPv6 IPv6 : lsof -i 6 513 514 515 wonderland.cc.purdue.edu : lsof -i @wonderland.cc.purdue.edu:513-515 mace.cc.purdue.edu (cc.purdue.edu ) : lsof -i @mace <> 1234 456 123 789 : lsof -p 456,123,789 -u 1234,abe /dev/hd4 : lsof /dev/hd4 /u/abe/foo : lsof -Q /u/abe/foo /u/abe/foo : lsof /u/abe/foo echo "still in use" SIGHUP /u/abe/bar : kill -HUP `lsof -t /u/abe/bar` UNIX /dev/log : lsof /dev/log NFS /nfs/mount/point (mount table) /nfs/mount/point : lsof -b /nfs/mount/point : lsof -bw /nfs/mount/point : lsof -Di PID inode : lsof -FpcfDi 1 3 lsof <> 10 : lsof -c lsof -a -d 1 -d 3 -u abe -r10 'o' 'O' (regular expression) -c c : lsof -c /^..o.$/i -a -d cwd 4 (IPv4) : lsof -i@128.210.15.17 6 (IPv6) ( UNIX IPv6 ) : lsof -i@[0:1:2:3:4:5:6:7] 6 (IPv6) ( UNIX IPv6 ) - loop-back - : lsof -i@[::1] : lsof -rm====%T==== : lsof -r "m==== %T ====" (BUGS) lsof . (record lock) ( ) . Lsof name set-UID root . set-GID ( ) . (raw socket) ( ping) UNIX . (protocol control block) . Lsof Solaris ls(1) . (major) (minor) lstat(2) stat(2) CD-ROM ( /cdrom) CD-ROM ( /dev/sr0). (Lsof .) /proc BSD Tru64 UNIX SYSV R4 - FreeBSD NetBSD OpenBSD Solaris UnixWare . /proc - inode - . /proc . (txt) . mem . Lsof (named pipes) Tru64 UNIX lstat(2) . Lsof HP-UX 9.01 10.20 11.00 . FAQ lsof ( FAQ ) . AIX SMT . (15) /usr/include/sys/file.h AIX . X DISPLAY <<:0.0>> . +|-f[cfn] /proc lsof . (ENVIRONMENT) Lsof . LANG (locale) . LANG ( LC_ALL LC_TYPE ) setlocale(3) . LSOFDEVCACHE (device cache) . DEVICE CACHE PATH FROM AN ENVIRONMENT VARIABLE . LSOFPERSDCPATH . MODIFIED PERSONAL DEVICE CACHE PATH . (FAQ) (FAQ) 00FAQ lsof . : https://github.com/lsof-org/lsof/blob/master/00FAQ (FILES) /dev/kmem /dev/mem /dev/swap (paging) .lsof_hostname lsof ( hostname gethostname(2) .) (AUTHORS) Lsof Victor A.Abell (Purdue University) . 4.93.0 lsof-org GitHub lsof . lsof . 00CREDITS lsof . (DISTRIBUTION) lsof : https://github.com/lsof-org/lsof/releases (SEE ALSO) lsof . access(2), awk(1), crash(1), fattach(3C), ff(1), fstat(8), fuser(1), gethostname(2), isprint(3), kill(1), localtime(3), lstat(2), modload(8), mount(8), netstat(1), ofiles(8L), open(2), perl(1), ps(1), readlink(2), setlocale(3), stat(2), strftime(3), time(2), uname(1). Revision-4.99.7 LSOF(8)