Questions tagged [lsof]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
1 answer
45 views

Nobody listens on port, yet something accepts connection on it

Here is some background information first, although it may not be relevant to the problem. I am learning Kubernetes and I set up a cluster where pi-hole runs as a service. I can access the admin ...
user avatar
  • 11
0 votes
0 answers
30 views

lsof: tell if memory mapped file is writable?

Can lsof (or another tool) tell if a memory-mapped file is currently mapped for writing (i.e. with PROT_WRITE)? Currently, I can only see that a file is memory-mapped, but contrarily to files that are ...
user avatar
  • 663
0 votes
0 answers
73 views

DF and DU show different usage, but LSOF shows no deleted files

I'm running Docker daemon on an RedHat host and Docker containers are being built here on a daily basis. After a couple of days the mount point reserved for the Docker daemon (/var/lib/docker) fills ...
user avatar
0 votes
1 answer
261 views

lsof is not working for me on Mac OS X 10.13 - gives error, I'm trying to find process accessing a specific IP address

lsof isn't working for me. I'm trying to use instructions in posts such as How do I find out which program and process ID accesses a given IP address in macOS? to find which process is accessing a ...
user avatar
0 votes
1 answer
4k views

Why Device or resource busy whent to remove the file?

/dev/sda4 is in ntfs file system ,and mounted on /mnt/winntfs with ntfsusermap(the most key point),the post list how to mount ntfs in linux step by step. how to mount ntfs in linux step by step sudo ...
user avatar
  • 53
0 votes
0 answers
41 views

what is the right approach to count the open files

what is the real way to verify open files what we do is that lsof | sort | uniq >/tmp/file so /tmp/file include all open files and the number of open files can be identified by wc -l /tmp/...
user avatar
0 votes
0 answers
731 views

It is safe to kill every process running on a port?

This is my problem. I'm running a Node.JS API on a Debian server using Nodemon (Because I'm currently programming on my server) and that API is on a Apache Virtual Host using a reverse proxy. I use ...
user avatar
  • 101
0 votes
1 answer
400 views

why the result of lsof | grep pid | wc -l and lsof -p pid |wc -l is different?

why the result of lsof | grep pid | wc -l and lsof -p pid |wc -l is different? the result of lsof -p | pid | wc -l is similar as ls /proc/pid/fd | wc -l, but the result of lsof | grep pid(or process ...
user avatar
  • 1
1 vote
0 answers
109 views

OS X Spell Service opens too many files?

I found this question, Is there a fix for the "Too many open files in system" error on OS X 10.7.1? , and specifically this answer https://superuser.com/a/1180084/177312 and the output ...
user avatar
  • 552
1 vote
1 answer
59 views

Intercept environment variables read by a process

I have a process that’s reading some environment variables to set itself up, but I’m not sure which one. The programming language is foreign to me, so let’s supposed I don’t have the source. Is there ...
user avatar
  • 117
1 vote
1 answer
1k views

UDP port appears in netstat but not in lsof?

After using Mosh, I noticed that UDP ports held by mosh-server were still in use after all processes exited. Running netstat -ln, it shows that these ports are in use: Active Internet connections ...
user avatar
  • 261
1 vote
1 answer
1k views

How to find out the PID which generates traffics to port 9229 in MacBook

There are unknown traffics to port 9229 in my MacBook. $ sudo tcpdump -i any -n port 9229 ...... 12:10:39.176502 IP6 ::1.62261 > ::1.9229: Flags [S], seq 638850191, win 65535, options [mss 16324,...
user avatar
  • 31
1 vote
2 answers
2k views

Why lsof -p and just lsof return drastically different results?

I currently have set a open files limit of 100000 but lsof reports that it's close to running out. Running lsof -n | awk '{print $2'} | sort | uniq -c | sort -n results in: 1 PID 90321 3979 ...
user avatar
2 votes
1 answer
1k views

How to check which process is flooding TCP SYN connections on Linux?

My Server is running Fedora Core 13. One day I found there were a lot of abnormal traffic that tried to initiate TCP connections with outside hosts. I tried to remove the default route and the DNS ...
user avatar
  • 21
1 vote
2 answers
3k views

Lsof command in repeat mode no interval

How can you set the timing of lsof to sub 1 second? On lsof -r (repeat mode), is the minimum value 1 second? Is there a way to have a continuous monitoring with lsof without having intervals between 2 ...
user avatar
  • 11
2 votes
0 answers
241 views

lsof: restrict to sockets available via loopback

I can restrict the selection to sockets listening only on the loopback interface: $ lsof -p "$(pgrep -d, proga)" -i4TCP@127.0.0.1 -sTCP:LISTEN -P -n -a COMMAND PID USER FD TYPE DEVICE SIZE/OFF ...
user avatar
  • 531
1 vote
3 answers
2k views

My web server and web browser appear to be using port 80 at the same time

If I, on OS X, Start Firefox. Start Google Chrome. Start a Ruby on Rails server on port 80 (using RVM) rvmsudo rails -p 80 Use lsof to look at what is running on port 80 sudo lsof -i:80 Then I ...
user avatar
11 votes
2 answers
45k views

Closing open file without killing the process

I have java(yeah java...) application running on CentOS 7. After a while, there are many "deleted" files that bother me. for deleted files used(not the issue): lsof | grep "(deleted)" I found them ...
user avatar
  • 423
1 vote
0 answers
131 views

Per-process network usage on OSX?

I want to periodically poll for per-process network usage. Is there a way to do this efficiently in OSX like netstat -p on Linux? I know there's lsof -i -Tqsf but it doesn't seem to show bytes sent/...
user avatar
  • 111
1 vote
2 answers
2k views

Counting the number of open files for each user?

I am looking for a command that would list me number of open files for each user, sorted descending. For example lsof -u postgres | wc - would list them only for the postgres user, but I do want to ...
user avatar
  • 11.2k
4 votes
2 answers
2k views

How can I find all files open within a given directory?

I know I can use lsof to list open files, and I know I can use find to find files by inode within a given directory. But how can I effectively combine these two programs to list all open files which ...
user avatar
  • 1,900
1 vote
1 answer
439 views

How can I check which computers I am logged onto on my school network?

At some point in the last week, I forgot to log out of a computer somewhere in my school and now I cannot open firefox because it is already open on that computer. Is there a shell command for me to ...
user avatar
1 vote
2 answers
319 views

linux reverse engineer to find process source

A compromised wordpress site has started several processes that run as the apache user. I can find these processes by running ps and greping for the apache user. Then I take one of the process IDs and ...
user avatar
  • 13
5 votes
2 answers
4k views

How can I print file names on linux command if know its file descriptor of a file opened by a process?

I know the file descriptor of a file opened by a process, but I don't know the process ID. How can I print file names from the Linux command prompt if I know the file descriptor of a file opened by a ...
user avatar
  • 377
1 vote
1 answer
922 views

How can I get file names of opened by a process?

I want to list down all file names opened by init process. I know about /proc/PID/fd directory. But that gives file descriptors only. How can I get file names from list of file descriptors?
user avatar
  • 377
4 votes
2 answers
21k views

Can't unmount dmg. Keep getting "Resource Busy"

"Workspace" is an encrypted dmg where I keep my code. I don't usually unmout it but I need to take a backup and it's refusing to let me unmount: mark@mark-macbook-air /Volumes$ lsof | grep Workspace ...
user avatar
  • 141
1 vote
2 answers
1k views

What does *:* in lsof output stand for?

While executing the command /usr/sbin/lsof -l -i -P -n as the root user, I am getting this output. COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME ... httpd 9164 70 3u ...
user avatar
  • 111
1 vote
3 answers
2k views

mv: cannot move «file.mp4» to «/path/file.mp4»: Device or resource busy*

I simply try to move file to another path and I'm getting mv: cannot move «file.mp4» to «/path/file.mp4»: Device or resource busy* I've tried using lsof, but it's not showing any openfiles. lsof +D ...
user avatar
  • 1,547
7 votes
1 answer
2k views

lsof reports no files open on external volume but it still cannot be safely unmounted

I've searched around here on SX and other places but have not found an approach that gives me any traction on my issue. I've a volume (used by Time Machine as it happens) on an external Firewire ...
user avatar
  • 185
0 votes
1 answer
295 views

Better use of lsof in Linux?

I'm looking for a way to list open files by the Flash plugin (whether Firefox or Chrome). I could use lsof | grep Flash, and it works. But I'm looking for a more efficient way to do that, using lsof ...
user avatar
  • 1
2 votes
3 answers
10k views

Listing active *and past* network connections

On Linux, I know that I can list active network connections with lsof -i or netstat. However, as far as I know, this only list connections that are currently open. If a process makes a short ...
user avatar
1 vote
1 answer
189 views

How to determine full command with args given a pid (or port in use)

I've got this nice bash function for telling me the pid using a port: using_port() { lsof -i:${1} } Output looks like this: COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME ...
user avatar
  • 1,413
4 votes
2 answers
743 views

How can I programmatically “eject” a keychain on OS X?

I'm using a script to eject a small USB key I use as a “identity” drive, which contains some secure information. Of note, it has an OS X “keychain” file on it, which contains some of my more secure ...
user avatar
  • 1,975
0 votes
2 answers
4k views

How to quickly determine which process (if any) listens to a serial port

I am looking for a command to see the process listening to a port, e.g. /dev/ttyS0 (with root rights on a Linux system). I can do that with lsof /dev/ttyS0 but this is really too slow. Also, I ...
user avatar
  • 463
2 votes
2 answers
2k views

Mac lsof command find all processes for all users

A while ago my teacher asked me to create a script that would kill Minecraft anytime it came up. It worked when the user themselves ran it, but it didn't if it was at root level. Is there a command ...
user avatar
  • 145
5 votes
2 answers
1k views

Find processes listening on the wildcard address in `lsof`

Using lsof, I can find all of the processes with a TCP socket listening for connections: lsof -Pni -sTCP:LISTEN e.g.: COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME cupsd 662 root ...
user avatar
  • 537
1 vote
1 answer
691 views

How can I unbind a UDP port that has no entry in lsof?

On my Mac, I have a UDP port that is "already in use", but doesn't have an associated process: sudo netstat -na | grep "udp.*\.500\>" shows udp4 0 0 192.168.50.181.500 *.* ...
user avatar
4 votes
1 answer
5k views

How to install lsof on Debian/kFreeBSD?

How do you install lsof on Debian/kFreeBSD Testing (Wheezy/Sid)? $ apt-get install lsof Package lsof is not available, but is referred to by another package. This may mean that the package is missing,...
user avatar
  • 2,432
1 vote
1 answer
2k views

How to convert lsof hexadecimal IP:port output to decimal notation?

I feel dumb for asking but how do I convert this to the IP port combination? IPV4 0xffffff8015f9aa40
user avatar
  • 523
1 vote
1 answer
190 views

Why Does Issuing One lsof Launches Two Processes?

I'm on current OS X 10.7. Sometimes I want to check which application locks a certain file. I do that by lsof | grep $FILENAME I noticed that running this command invokes two instances of lsof. Why ...
user avatar
  • 1,710
7 votes
2 answers
20k views

Debugging connection timeouts using strace?

I'm trying to figure out why is Eclipse spinning, so I decided to fire up strace. I found the eclipse process using: $ ps ax | grep java 5546 ? Sl 19:04 /usr/bin/java ... [arguments ...
user avatar
  • 1,317
28 votes
3 answers
28k views

Continuously monitor files opened/accessed by a process

lsof -p 12345 will list all the files opened by process whose pid is 12345 but only for a particular instant of time. How can we continuously monitor a process from the start to end(until process is ...
user avatar
  • 1,109
2 votes
1 answer
1k views

Periodically printing the number of open files for a process

I can use a program like top to periodically update system statistics and I can use lsof -p <pid> | wc -l to give me a snapshot of the number open files for a process. Is there a command I can ...
user avatar
  • 504
1 vote
2 answers
1k views

How many files should be listed as open under lsof?

I am not an advanced Linux user. I have a VPS with 768MB of RAM running CentOS. I executed the lsof command as root and I see that there is a list of 3000 files. Usually, how many files should be ...
user avatar
  • 2,763
3 votes
1 answer
73 views

Is there a way to know WHEN a connection has been established?

I'm working with mobile IPv6 and was dealing with lots of zombie connections. I set keepAlive to true and want to test whether old connections are being discarded. I'm using lsof to list the process ...
user avatar
2 votes
4 answers
3k views

How to move files that are not in use?

I want to move files in a directory that are not currently in use. I have a sense that some combination of lsof, find, and xargs could work but I can't quite get there. So far, I created the ...
user avatar
  • 8,662