From Wiki-UX.info

Lsof Examples
Jump to: navigation, search

Lsof Examples

Below you will find a set of examples using the lsof tool.

For a more extensive set of examples, documented more fully, see the 00QUICKSTART file of the lsof distribution.

If you need to download the lsof tool you can go to one of these links:

Note: The lsof tool is a third party and nonsupported tool by HP.

Examples

To list all open files, use:

# lsof

To list all open Internet, x.25 (HP-UX), and UNIX domain files, use:

# lsof -i -U

To list all open IPv4 network files in use by the process whose PID is 1234, use:

# lsof -i 4 -a -p 1234

Presuming the UNIX dialect supports IPv6, to list only open IPv6 network files, use:

# lsof -i 6

To list all processes using a particular network port, use:

# lsof -i :<Port#>

To list all files using any protocol on ports 513, 514, or 515 of host wonderland.cc.purdue.edu, use:

# lsof -i @wonderland.cc.purdue.edu:513-515

To list all files using any protocol on any port of mace.cc.purdue.edu (cc.purdue.edu is the default domain), use:

# lsof -i @mace

To list all open files for login name ``abe, or user ID 1234, or process 456, or process 123, or process 789, use:

# lsof -p 456,123,789 -u 1234,abe

To list all open files on device /dev/hd4, use:

# lsof /dev/hd4

To find the process that has /u/abe/foo open, use:

# lsof /u/abe/foo

To send a SIGHUP to the processes that have /u/abe/bar open, use:

# kill -HUP `lsof -t /u/abe/bar`

To find any open file, including an open UNIX domain socket file, with the name /dev/log, use:

# lsof /dev/log

To find processes with open files on the NFS file system named /nfs/mount/point whose server is inaccessible, and presuming your mount table supplies the device number for /nfs/mount/point, use:

# lsof -b /nfs/mount/point

To do the preceding search with warning messages suppressed, use:

# lsof -bw /nfs/mount/point

To ignore the device cache file, use:

# lsof -Di

To obtain PID and command name field output for each process, file descriptor, file device number, and file inode number for each file of each process, use:

# lsof -FpcfDi

To list the files at descriptors 1 and 3 of every process running the lsof command for login ID ``abe every 10 seconds, use:

# lsof -c lsof -a -d 1 -d 3 -u abe -r10

To list the current working directory of processes running a command that is exactly four characters long and has an 'o' or 'O' in character three, use this regular expression form of the -c c option:

# lsof -c /^..o.$/i -a -d cwd

To find an IP version 4 socket file by its associated numeric dot-form address, use:

# lsof -i@128.210.15.17

To find an IP version 6 socket file (when the UNIX dialect supports IPv6) by its associated numeric colon-form address, use:

# lsof -i@[0:1:2:3:4:5:6:7]

To find an IP version 6 socket file (when the UNIX dialect supports IPv6) by an associated numeric colon-form address that has a run of zeroes in it - e.g., the loop-back address use:

# lsof -i@[::1]

Reference

Authors

This page was last modified on 1 October 2009, at 11:29. This page has been accessed 4,809 times.