lsof command for monitoring
\nIn Linux operating system lsof is powerfull tool for find out various kinds of status and list of open files from all over the system, there are various options provided in lsof which helps a lot to a Linux admin in his\/her day to day life. In this post I am just trying to capture various lsof examples that I am using most of times in my present setup<\/p>\n
1. Open TCP and UDP ports with running protocols
\n Want to see open Ports, both TCP and UDP ports. In this command output Port numbers will not display<\/p>\n
[root@server ~]# lsof -i
\nCOMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
\nportmap 6805 rpc 3u IPv4 12002 UDP *:sunrpc
\nportmap 6805 rpc 4u IPv4 12010 TCP *:sunrpc (LISTEN)
\nrpc.statd 6844 root 3u IPv4 12088 UDP *:purenoise
\nrpc.statd 6844 root 6u IPv4 12072 UDP *:mac-srvr-admin
\nrpc.statd 6844 root 7u IPv4 12132 TCP *:mdqs (LISTEN)
\nhpiod 7086 root 0u IPv4 12657 TCP server:2208 (LISTEN)
\npython 7091 root 4u IPv4 12686 TCP server:2207 (LISTEN)
\nsshd 7121 root 3u IPv6 12743 TCP *:ssh (LISTEN)
\ncupsd 7161 root 3u IPv4 12812 TCP server:ipp (LISTEN)
\ncupsd 7161 root 5u IPv4 12815 UDP *:ipp
\nsendmail 7204 root 4u IPv4 12947 TCP server:smtp (LISTEN)
\navahi-dae 7347 avahi 13u IPv4 13269 UDP *:mdns
\navahi-dae 7347 avahi 14u IPv6 13270 UDP *:mdns
\navahi-dae 7347 avahi 15u IPv4 13271 UDP *:filenet-tms
\navahi-dae 7347 avahi 16u IPv6 13272 UDP *:filenet-rpc
\nsshd 7528 root 3u IPv6 15320 TCP 192.168.1.110:ssh->192.168.1.3:49232 (ESTABLISHED)<\/p>\n
2. Open ports with Port numbers
\nThis is same command, but it just display Port numbers as well instead of protocol
\n[root@server ~]# lsof -i -P
\nCOMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
\nportmap 6805 rpc 3u IPv4 12002 UDP *:111
\nportmap 6805 rpc 4u IPv4 12010 TCP *:111 (LISTEN)
\nrpc.statd 6844 root 3u IPv4 12088 UDP *:663
\nrpc.statd 6844 root 6u IPv4 12072 UDP *:660
\nrpc.statd 6844 root 7u IPv4 12132 TCP *:666 (LISTEN)
\nhpiod 7086 root 0u IPv4 12657 TCP server:2208 (LISTEN)
\npython 7091 root 4u IPv4 12686 TCP server:2207 (LISTEN)
\nsshd 7121 root 3u IPv6 12743 TCP *:22 (LISTEN)
\ncupsd 7161 root 3u IPv4 12812 TCP server:631 (LISTEN)
\ncupsd 7161 root 5u IPv4 12815 UDP *:631
\nsendmail 7204 root 4u IPv4 12947 TCP server:25 (LISTEN)
\navahi-dae 7347 avahi 13u IPv4 13269 UDP *:5353
\navahi-dae 7347 avahi 14u IPv6 13270 UDP *:5353
\navahi-dae 7347 avahi 15u IPv4 13271 UDP *:32768
\navahi-dae 7347 avahi 16u IPv6 13272 UDP *:32769
\nsshd 7528 root 3u IPv6 15320 TCP 192.168.1.110:22->192.168.1.3:49232 (ESTABLISHED)<\/p>\n
3. Open Ports numbers with their process Id numbers
\nAbove commands will display Process id of backend process that cause this port up, but in below command will also display parent process IDs of process. Some time we also need to know parent process of process which cause this port up.
\n[root@server ~]# lsof -i -P +R
\nCOMMAND PID PPID USER FD TYPE DEVICE SIZE NODE NAME
\nportmap 6805 1 rpc 3u IPv4 12002 UDP *:111
\nportmap 6805 1 rpc 4u IPv4 12010 TCP *:111 (LISTEN)
\nrpc.statd 6844 1 root 3u IPv4 12088 UDP *:663
\nrpc.statd 6844 1 root 6u IPv4 12072 UDP *:660
\nrpc.statd 6844 1 root 7u IPv4 12132 TCP *:666 (LISTEN)
\nhpiod 7086 1 root 0u IPv4 12657 TCP server:2208 (LISTEN)
\npython 7091 1 root 4u IPv4 12686 TCP server:2207 (LISTEN)
\nsshd 7121 1 root 3u IPv6 12743 TCP *:22 (LISTEN)
\ncupsd 7161 1 root 3u IPv4 12812 TCP server:631 (LISTEN)
\ncupsd 7161 1 root 5u IPv4 12815 UDP *:631
\nsendmail 7204 1 root 4u IPv4 12947 TCP server:25 (LISTEN)
\navahi-dae 7347 1 avahi 13u IPv4 13269 UDP *:5353
\navahi-dae 7347 1 avahi 14u IPv6 13270 UDP *:5353
\navahi-dae 7347 1 avahi 15u IPv4 13271 UDP *:32768
\navahi-dae 7347 1 avahi 16u IPv6 13272 UDP *:32769
\nsshd 7528 7121 root 3u IPv6 15320 TCP 192.168.1.110:22->192.168.1.3:49232 (ESTABLISHED)<\/p>\n
4. Port working for TCP only
\nAbove commands are used for TCP and UDP ports, but in case we only want to display TCP or UDP ports. Below command will able to display it.
\n [root@server ~]# lsof -itcp
\nCOMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
\nportmap 6805 rpc 4u IPv4 12010 TCP *:sunrpc (LISTEN)
\nrpc.statd 6844 root 7u IPv4 12132 TCP *:mdqs (LISTEN)
\nhpiod 7086 root 0u IPv4 12657 TCP server:2208 (LISTEN)
\npython 7091 root 4u IPv4 12686 TCP server:2207 (LISTEN)
\nsshd 7121 root 3u IPv6 12743 TCP *:ssh (LISTEN)
\ncupsd 7161 root 3u IPv4 12812 TCP server:ipp (LISTEN)
\nsendmail 7204 root 4u IPv4 12947 TCP server:smtp (LISTEN)
\nsshd 7528 root 3u IPv6 15320 TCP 192.168.1.110:ssh->192.168.1.3:49232 (ESTABLISHED)
\nvsftpd 7648 root 3u IPv4 18398 TCP *:ftp (LISTEN)
\nrpc.rquot 7770 root 4u IPv4 18813 TCP *:netrcs (LISTEN)
\nrpc.mount 7813 root 7u IPv4 18896 TCP *:784 (LISTEN)
\nypserv 7855 root 6u IPv4 19065 TCP *:itm-mcell-s (LISTEN)<\/p>\n
5. Display specific ports
\nAbove commands will cover all ports but sometime we just need to know status of only one port like mentioned in below command.
\n[root@server ~]# lsof -i :25
\nCOMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
\nsendmail 7204 root 4u IPv4 12947 TCP server:smtp (LISTEN)<\/p>\n
6. Display range of ports
\nIn some requirements, we need to know status of some port range like 1-100 ports. we can use below commands for this
\n[root@client ~]# lsof -i :1-100
\nCOMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
\nsshd 7125 root 3u IPv6 12891 TCP *:ssh (LISTEN)
\nsendmail 7196 root 4u IPv4 13081 TCP server:smtp (LISTEN)
\nsshd 7513 root 3u IPv6 15376 TCP 192.168.1.101:ssh->192.168.1.3:49298 (ESTABLISHED)
\nsshd 7607 root 3u IPv6 15570 TCP 192.168.1.101:ssh->192.168.1.3:49999 (ESTABLISHED)
\nsshd 19026 root 3u IPv6 58713 TCP 192.168.1.101:ssh->192.168.1.3:50134 (ESTABLISHED)
\nsshd 19838 root 3u IPv6 61673 TCP 192.168.1.101:ssh->192.168.1.3:50784 (ESTABLISHED)
\nsshd 19840 u1 3u IPv6 61673 TCP 192.168.1.101:ssh->192.168.1.3:50784 (ESTABLISHED)<\/p>\n
7. Display open udp ports
\n[root@server ~]# lsof -iudp
\nCOMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
\nportmap 6805 rpc 3u IPv4 12002 UDP *:sunrpc
\nrpc.statd 6844 root 3u IPv4 12088 UDP *:purenoise
\nrpc.statd 6844 root 6u IPv4 12072 UDP *:mac-srvr-admin
\ncupsd 7161 root 5u IPv4 12815 UDP *:ipp
\navahi-dae 7347 avahi 13u IPv4 13269 UDP *:mdns
\navahi-dae 7347 avahi 14u IPv6 13270 UDP *:mdns
\navahi-dae 7347 avahi 15u IPv4 13271 UDP *:filenet-tms
\navahi-dae 7347 avahi 16u IPv6 13272 UDP *:filenet-rpc
\nrpc.rquot 7770 root 3u IPv4 18807 UDP *:739
\nrpc.mount 7813 root 6u IPv4 18893 UDP *:781
\nypserv 7855 root 5u IPv4 19060 UDP *:825
\nrpc.yppas 7887 root 4u IPv4 19123 UDP *:856<\/p>\n
8. open files in specfic directory, will not search recursive
\n[root@server ~]# lsof +d \/var\/run\/
\nCOMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
\naudispd 6717 root 5u unix 0xc1bf4900 11829 \/var\/run\/audispd_events
\nrpc.statd 6844 root 8w REG 253,0 5 3202319 \/var\/run\/rpc.statd.pid
\nsdpd 6939 root 5u unix 0xf6a45580 12350 \/var\/run\/sdp
\npcscd 7001 root mem REG 253,0 65537 3202338 \/var\/run\/pcscd.pub
\npcscd 7001 root 3u REG 253,0 65537 3202338 \/var\/run\/pcscd.pub
\npcscd 7001 root 5u unix 0xf63eae40 12465 \/var\/run\/pcscd.comm
\nautomount 7046 root 9u FIFO 253,0 3202343 \/var\/run\/autofs.fifo-misc
\nautomount 7046 root 15u FIFO 253,0 3202345 \/var\/run\/autofs.fifo-net
\nacpid 7070 root 4u unix 0xf63ea900 12623 \/var\/run\/acpid.socket
\nacpid 7070 root 5u unix 0xf3efac80 14735 \/var\/run\/acpid.socket
\nhpiod 7086 root 3u REG 253,0 5 3202351 \/var\/run\/hpiod.pid
\npython 7091 root 3u REG 253,0 5 3202354 \/var\/run\/hpssd.pid
\nsendmail 7204 root 5wW REG 253,0 33 3202368 \/var\/run\/sendmail.pid
\nsendmail 7212 smmsp 4wW REG 253,0 49 3202372 \/var\/run\/sm-client.pid<\/p>\n
9. open files in specfic directory, will search recursive as well
\n[root@server ~]# lsof +D \/proc\/
\nCOMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
\nklogd 6753 root 0r REG 0,3 0 4026531849 \/proc\/kmsg
\nrpc.idmap 6890 root 4u REG 0,3 0 4026532773 \/proc\/net\/rpc\/nfs4.nametoid\/channel
\nrpc.idmap 6890 root 9u REG 0,3 0 4026532769 \/proc\/net\/rpc\/nfs4.idtoname\/channel
\nacpid 7070 root 3r REG 0,3 0 4026532142 \/proc\/acpi\/event
\nhald 7364 haldaemon 11r REG 0,3 0 482607121 \/proc\/7364\/mounts
\nrpc.mount 7813 root 3u REG 0,3 0 4026532568 \/proc\/net\/rpc\/auth.unix.ip\/channel
\nrpc.mount 7813 root 4u REG 0,3 0 4026532761 \/proc\/net\/rpc\/nfsd.export\/channel
\nrpc.mount 7813 root 5u REG 0,3 0 4026532765 \/proc\/net\/rpc\/nfsd.fh\/channel
\nlsof 20404 root 3r DIR 0,3 0 1 \/proc\/
\nlsof 20404 root 6r DIR 0,3 0 1337196553 \/proc\/20404\/fd<\/p>\n
10. Display Established connections
\n[root@server ~]# lsof -i @192.168.1.3
\nCOMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
\nsshd 7528 root 3u IPv6 15320 TCP 192.168.1.110:ssh->192.168.1.3:49232 (ESTABLISHED)<\/p>\n
[root@client ~]# lsof -i @192.168.1.110
\nCOMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
\nftp 20157 u1 3u IPv4 62569 TCP 192.168.1.101:36490->192.168.1.110:ftp (ESTABLISHED)
\nftp 20157 u1 4u IPv4 62569 TCP 192.168.1.101:36490->192.168.1.110:ftp (ESTABLISHED)<\/p>\n
11. Display open files per process id(pid)
\n[root@server ~]# lsof -p 7121
\nCOMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
\nsshd 7121 root cwd DIR 253,0 4096 2 \/
\nsshd 7121 root rtd DIR 253,0 4096 2 \/
\nsshd 7121 root txt REG 253,0 387308 2433014 \/usr\/sbin\/sshd
\nsshd 7121 root mem REG 253,0 261433 \/lib\/libutil-2.5.so (path inode=263739)
\nsshd 7121 root mem REG 253,0 2423991 \/usr\/lib\/libz.so.1.2.3 (path inode=2440370)
\nsshd 7121 root mem REG 253,0 2425597 \/usr\/lib\/libnssutil3.so (path inode=2430740)
\nsshd 7121 root mem REG 253,0 46680 261417 \/lib\/libnss_files-2.5.so
\nsshd 7121 root mem REG 253,0 261579 \/lib\/libcom_err.so.2.1 (path inode=263737)
\nsshd 7121 root mem REG 253,0 2425593 \/usr\/lib\/libplds4.so (path inode=2440382)
\nsshd 7121 root mem REG 253,0 261407 \/lib\/libdl-2.5.so (path inode=263715)
\nsshd 7121 root 0u CHR 1,3 1527 \/dev\/null
\nsshd 7121 root 1u CHR 1,3 1527 \/dev\/null
\nsshd 7121 root 2u CHR 1,3 1527 \/dev\/null
\nsshd 7121 root 3u IPv6 12743 TCP *:ssh (LISTEN)<\/p>\n
12. Disaply oprn files on User basis — This is NIS user, user’s process will not display on NIS Server
\n[root@client ~]# lsof -u u1
\nCOMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
\nsshd 19190 u1 cwd DIR 253,0 4096 2 \/
\nsshd 19190 u1 rtd DIR 253,0 4096 2 \/
\nsshd 19190 u1 txt REG 253,0 387308 2433014 \/usr\/sbin\/sshd
\nsshd 19190 u1 mem REG 253,0 45288 261596 \/lib\/libcrypt-2.5.so
\nsshd 19190 u1 mem REG 253,0 8072 263733 \/lib\/libkeyutils-1.2.so
\nsshd 19190 u1 mem REG 253,0 11460 2440345 \/usr\/lib\/libplds4.so
\nsshd 19190 u1 mem REG 253,0 29856 2438824 \/usr\/lib\/libcrack.so.2.8.0
\nsshd 19190 u1 mem REG 253,0 125736 263713 \/lib\/ld-2.5.so
\nsshd 19190 u1 mem REG 253,0 1242224 263719 \/lib\/libcrypto.so.0.9.8b
\nsshd 19190 u1 mem REG 253,0 190712 2440341 \/usr\/lib\/libgssapi_krb5.so.2.2
\nsshd 19190 u1 mem REG 253,0 600084 2440340 \/usr\/lib\/libkrb5.so.3.3
\nsshd 19190 u1 mem REG 253,0 228028 2434949 \/usr\/lib\/libnspr4.so
\nsshd 19190 u1 mem REG 253,0 125744 263720 \/lib\/libpthread-2.5.so
\nsshd 19190 u1 3u IPv6 59141 TCP 192.168.1.101:ssh->192.168.1.3:50257 (ESTABLISHED)<\/p>\n
13. Display Process holding for certain file descriptor
\n[root@server ~]# lsof -d 15
\nCOMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
\nautomount 7046 root 15u FIFO 253,0 3202345 \/var\/run\/autofs.fifo-net
\navahi-dae 7347 avahi 15u IPv4 13271 UDP *:filenet-tms
\nhald 7364 haldaemon 15u unix 0xf3efaac0 15006 socket<\/p>\n
14. Display all Ipv4 connections
\n[root@server ~]# lsof -i4
\nCOMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
\nportmap 6805 rpc 3u IPv4 12002 UDP *:sunrpc
\nportmap 6805 rpc 4u IPv4 12010 TCP *:sunrpc (LISTEN)
\nrpc.statd 6844 root 3u IPv4 12088 UDP *:purenoise
\nrpc.statd 6844 root 6u IPv4 12072 UDP *:mac-srvr-admin
\nrpc.statd 6844 root 7u IPv4 12132 TCP *:mdqs (LISTEN)
\nhpiod 7086 root 0u IPv4 12657 TCP server:2208 (LISTEN)
\npython 7091 root 4u IPv4 12686 TCP server:2207 (LISTEN)
\ncupsd 7161 root 3u IPv4 12812 TCP server:ipp (LISTEN)
\ncupsd 7161 root 5u IPv4 12815 UDP *:ipp
\nsendmail 7204 root 4u IPv4 12947 TCP server:smtp (LISTEN)
\navahi-dae 7347 avahi 13u IPv4 13269 UDP *:mdns
\navahi-dae 7347 avahi 15u IPv4 13271 UDP *:filenet-tms
\nvsftpd 7648 root 3u IPv4 18398 TCP *:ftp (LISTEN)
\nrpc.rquot 7770 root 3u IPv4 18807 UDP *:739
\nrpc.rquot 7770 root 4u IPv4 18813 TCP *:netrcs (LISTEN)
\nrpc.mount 7813 root 6u IPv4 18893 UDP *:781
\nrpc.mount 7813 root 7u IPv4 18896 TCP *:784 (LISTEN)
\nypserv 7855 root 5u IPv4 19060 UDP *:825
\nypserv 7855 root 6u IPv4 19065 TCP *:itm-mcell-s (LISTEN)
\nrpc.yppas 7887 root 4u IPv4 19123 UDP *:856<\/p>\n
15. Diaply process running on a open file
\n[root@client ~]# lsof \/var\/log\/messages
\nCOMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
\nsyslogd 6742 root 1w REG 253,0 106636 3201966 \/var\/log\/messages<\/p>\n
16. Display list of process that start of a command name
\n[root@server ~]# lsof -c ypserv
\nCOMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
\nypserv 7855 root cwd DIR 253,0 4096 3201900 \/var\/yp
\nypserv 7855 root rtd DIR 253,0 4096 2 \/
\nypserv 7855 root txt REG 253,0 44232 2440342 \/usr\/sbin\/ypserv
\nypserv 7855 root mem REG 253,0 2424344 \/usr\/lib\/libgdbm.so.2.0.0 (path inode=2434857)
\nypserv 7855 root 3uW REG 253,0 5 3202541 \/var\/run\/ypserv.pid
\nypserv 7855 root 5u IPv4 19060 UDP *:825
\nypserv 7855 root 6u IPv4 19065 TCP *:itm-mcell-s (LISTEN)
\nypserv 7855 root 7r REG 253,0 12503 4018684 \/var\/yp\/linuxphobia\/hosts.byaddr
\nypserv 7855 root 8r REG 253,0 12472 4018679 \/var\/yp\/linuxphobia\/passwd.byname
\nypserv 7855 root 9r REG 253,0 12472 4018680 \/var\/yp\/linuxphobia\/passwd.byuid
\nypserv 7855 root 10r REG 253,0 12414 4018681 \/var\/yp\/linuxphobia\/group.byname
\nypserv 7855 root 11r REG 253,0 12414 4018682 \/var\/yp\/linuxphobia\/group.bygid
\nypserv 7855 root 12r REG 253,0 12586 4018683 \/var\/yp\/linuxphobia\/hosts.byname<\/p>\n
17. Display process working on mountpints
\n[root@client ~]# lsof \/home
\nCOMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
\nautomount 7772 root 21r DIR 0,23 0 16112 \/home<\/p>\n
18. Display process running from users except those mentioned user
\n[root@client ~]# lsof -u ^root -u ^u1 -u ^rpc -u ^haldaemon -u ^avahi -u ^xfs -u ^smmsp
\nCOMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
\ndbus-daem 6911 dbus cwd DIR 253,0 4096 2 \/
\ndbus-daem 6911 dbus rtd DIR 253,0 4096 2 \/
\ndbus-daem 6911 dbus txt REG 253,0 351900 4639486 \/bin\/dbus-daemon
\ndbus-daem 6911 dbus mem REG 253,0 261425 \/lib\/libpthread-2.5.so (path inode=263720)
\ndbus-daem 6911 dbus mem REG 253,0 261407 \/lib\/libdl-2.5.so (path inode=263715)
\ndbus-daem 6911 dbus mem REG 253,0 46680 261417 \/lib\/libnss_files-2.5.so
\ndbus-daem 6911 dbus mem REG 253,0 261457 \/lib\/libcap.so.1.10 (path inode=263730)
\ndbus-daem 6911 dbus mem REG 253,0 261451 \/lib\/libaudit.so.0.0.0 (path inode=263716)
\ndbus-daem 6911 dbus mem REG 253,0 261567 \/lib\/libselinux.so.1 (path inode=263736)
\ndbus-daem 6911 dbus mem REG 253,0 261394 \/lib\/ld-2.5.so (path inode=263713)
\ndbus-daem 6911 dbus mem REG 253,0 261455 \/lib\/libexpat.so.0.5.0 (path inode=263725)
\ndbus-daem 6911 dbus mem REG 253,0 261472 \/lib\/libsepol.so.1 (path inode=263735)
\ndbus-daem 6911 dbus mem REG 253,0 261401 \/lib\/libc-2.5.so (path inode=263714)
\ndbus-daem 6911 dbus 0u CHR 1,3 1527 \/dev\/null
\ndbus-daem 6911 dbus 1u CHR 1,3 1527 \/dev\/null
\ndbus-daem 6911 dbus 2u CHR 1,3 1527 \/dev\/null
\ndbus-daem 6911 dbus 3u unix 0xf6b9ce40 12419 \/var\/run\/dbus\/system_bus_socket
\ndbus-daem 6911 dbus 4u CHR 1,3 1527 \/dev\/null
\ndbus-daem 6911 dbus 5r DIR 253,0 4096 4051635 \/etc\/dbus-1\/system.d
\ndbus-daem 6911 dbus 6u unix 0xf6b9cc80 12421 socket
\ndbus-daem 6911 dbus 7u unix 0xf6b9cac0 12422 socket<\/p>\n
18. Display only print Process id (Pid) running from User
\n[root@client ~]# lsof -t -u ^root -u ^u1 -u ^rpc -u ^haldaemon -u ^avahi -u ^xfs -u ^smmsp
\n6911<\/p>\n
19.Display only for specific user for specific command
\nSome time we want to display specific command for only specific user like in this With this options -a in last -c and -u will work together to print only bash command process for user u1
\n[root@srv3 ~]# lsof -c bash -u u1 -a
\nCOMMAND PID USER FD TYPE DEVICE SIZE\/OFF NODE NAME
\nbash 6050 u1 cwd DIR 253,0 4096 1633607 \/home\/u1
\nbash 6050 u1 rtd DIR 253,0 4096 2 \/
\nbash 6050 u1 txt REG 253,0 735804 326755 \/bin\/bash
\nbash 6050 u1 mem REG 253,0 130860 4410722 \/lib\/ld-2.5.so
\nbash 6050 u1 mem REG 253,0 1706232 4410738 \/lib\/libc-2.5.so
\nbash 6050 u1 mem REG 253,0 20668 4410769 \/lib\/libdl-2.5.so
\nbash 6050 u1 mem REG 253,0 13276 4410806 \/lib\/libtermcap.so.2.0.8
\nbash 6050 u1 mem REG 253,0 50848 4410760 \/lib\/libnss_files-2.5.so
\nbash 6050 u1 mem REG 253,0 56466992 1061342 \/usr\/lib\/locale\/locale-archive
\nbash 6050 u1 mem REG 253,0 25462 1143780 \/usr\/lib\/gconv\/gconv-modules.cache
\nbash 6050 u1 0u CHR 136,1 0t0 3 \/dev\/pts\/1
\nbash 6050 u1 1u CHR 136,1 0t0 3 \/dev\/pts\/1
\nbash 6050 u1 2u CHR 136,1 0t0 3 \/dev\/pts\/1
\nbash 6050 u1 255u CHR 136,1 0t0 3 \/dev\/pts\/1<\/p>\n
20.Real time lsof like top
\nDefault time is 15 second. This will repeat this till the process ends or terminated with an interrupt or quit signal in every 5 seconds.
\n[root@client ~]# lsof -u u1 -c cat -a +r5
\nCOMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
\ncat 19868 u1 cwd DIR 0,24 4096 2842495 \/home\/u1 (192.168.1.110:\/home\/u1)
\ncat 19868 u1 rtd DIR 253,0 4096 2 \/
\ncat 19868 u1 txt REG 253,0 23132 4639532 \/bin\/cat
\ncat 19868 u1 mem REG 253,0 125736 263713 \/lib\/ld-2.5.so
\ncat 19868 u1 mem REG 253,0 1602128 263714 \/lib\/libc-2.5.so
\ncat 19868 u1 mem REG 253,0 56417840 2423648 \/usr\/lib\/locale\/locale-archive
\ncat 19868 u1 0u CHR 136,0 2 \/dev\/pts\/0
\ncat 19868 u1 1w REG 0,24 0 2842504 \/home\/u1\/f1 (192.168.1.110:\/home\/u1)
\ncat 19868 u1 2u CHR 136,0 2 \/dev\/pts\/0
\n=======<\/p>\n
21. NFS files used by user u1
\n[root@client ~]# lsof -N -u u1 -a
\nCOMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
\nbash 19841 u1 cwd DIR 0,24 4096 2842495 \/home\/u1 (192.168.1.110:\/home\/u1)<\/p>\n","protected":false},"excerpt":{"rendered":"
lsof command for monitoring In Linux operating system lsof is powerfull tool for find out various kinds of status and list of open files from all over the system, there are various options provided in lsof which helps a lot to a Linux admin in his\/her day to day life. In this post I am […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[],"_links":{"self":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/7064"}],"collection":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=7064"}],"version-history":[{"count":1,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/7064\/revisions"}],"predecessor-version":[{"id":7065,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/7064\/revisions\/7065"}],"wp:attachment":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7064"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7064"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7064"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}