Sponsored Links

The power of lsof

It seems so many people don’t know about the power of this simple little command. So here are a few commands I find useful all the time for troubleshooting problems.

socket files, add -N for nfs
lsof -U

user files/sockets open, can be added to any option
lsof -u id

list open files on a device or partition
lsof /dev/hda1
lsof /dev/mapper/rootvg-var_lv

files open by process
lsof -p <pid>
lsof -c <name of process>

connected with range of ports
lsof -i @

narrow network connections search by port, server or host.
lsof –i :587
lsof –i :smtp
lsof –i

Get current number of open file descriptors:

lsof [-p pid] | wc -l

How to recover an open file (say zone files).

This is useful if a file in use gets deleted. This is only useful if the file is still loaded into memory but can save you hours worth of work. It works by using the /proc file system. To see it in action do ps aux > myfile.

  1. lsof | grep myfile (less      23203      root    4r      REG      253,0   119620      65589 /root/myfile (deleted))
  2. The first column gives you the name of the command associated with the process, the second column is the process id, and the number in the fourth column is the file descriptor (the “r” means that it’s a regular file).
  3. cp /proc/23203/fd/4 myfile.saved
  4. check the file to see if it is correct

I may give more details on recovering files if their is more interest in it. That was just a quick and dirty.

Comments are closed.