Questions tagged [lsof]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
9 votes
2 answers
5k views

How can I find all files open within a given directory?

I know I can use lsof to list open files, and I know I can use find to find files by inode within a given directory. But how can I effectively combine these two programs to list all open files which ...
0 votes
2 answers
5k views

How to quickly determine which process (if any) listens to a serial port

I am looking for a command to see the process listening to a port, e.g. /dev/ttyS0 (with root rights on a Linux system). I can do that with lsof /dev/ttyS0 but this is really too slow. Also, I ...
0 votes
1 answer
202 views

How to find files opened by a service/user (lsof is showing very inconsistent result)

I am having an issue which may be the result of a service having too many open files. I am trying to examine what files it has open and monitor how it changes over time. This is on CentOS 7 so I ...
0 votes
1 answer
95 views

Continuous Open-File-Handle Monitoring in Unix

In Unix do you know of a way to do continuous open-file-handle monitoring? I know of lsof, which has a maximum sampling rate of 1s. However, I'm looking to do the exact same thing except continuously, ...
0 votes
1 answer
1k views

Some remote addresses missing from chrome developer tools

For example, if I go onto the quantum computing stack exchange, lsof lists stackoverflow.com, with the ip address of 198.252.206.25. Or if I go onto reddit, it lists ec2-52-87-69-120.compute-1....
2 votes
0 answers
396 views

Want to figure out which process (pid) is deleting a file on Mac OS X

I have a weird issue where files are being deleted from my /tmp folder, sometimes in as little as 5 minutes from creation. Doesn't appear to be the standard clean-tmps part of the periodic scheduler ...
0 votes
1 answer
105 views

Nobody listens on port, yet something accepts connection on it

Here is some background information first, although it may not be relevant to the problem. I am learning Kubernetes and I set up a cluster where pi-hole runs as a service. I can access the admin ...
1 vote
1 answer
283 views

Intercept environment variables read by a process

I have a process that’s reading some environment variables to set itself up, but I’m not sure which one. The programming language is foreign to me, so let’s supposed I don’t have the source. Is there ...
0 votes
0 answers
247 views

DF and DU show different usage, but LSOF shows no deleted files

I'm running Docker daemon on an RedHat host and Docker containers are being built here on a daily basis. After a couple of days the mount point reserved for the Docker daemon (/var/lib/docker) fills ...
0 votes
1 answer
2k views

lsof is not working for me on Mac OS X 10.13 - gives error, I'm trying to find process accessing a specific IP address

lsof isn't working for me. I'm trying to use instructions in posts such as How do I find out which program and process ID accesses a given IP address in macOS? to find which process is accessing a ...
0 votes
1 answer
9k views

Why Device or resource busy whent to remove the file?

/dev/sda4 is in ntfs file system ,and mounted on /mnt/winntfs with ntfsusermap(the most key point),the post list how to mount ntfs in linux step by step. how to mount ntfs in linux step by step sudo ...
0 votes
0 answers
515 views

what is the right approach to count the open files

what is the real way to verify open files what we do is that lsof | sort | uniq >/tmp/file so /tmp/file include all open files and the number of open files can be identified by wc -l /tmp/...
2 votes
2 answers
2k views

Why lsof -p and just lsof return drastically different results?

I currently have set a open files limit of 100000 but lsof reports that it's close to running out. Running lsof -n | awk '{print $2'} | sort | uniq -c | sort -n results in: 1 PID 90321 3979 ...
2 votes
1 answer
1k views

How to check which process is flooding TCP SYN connections on Linux?

My Server is running Fedora Core 13. One day I found there were a lot of abnormal traffic that tried to initiate TCP connections with outside hosts. I tried to remove the default route and the DNS ...
12 votes
2 answers
54k views

Closing open file without killing the process

I have java(yeah java...) application running on CentOS 7. After a while, there are many "deleted" files that bother me. for deleted files used(not the issue): lsof | grep "(deleted)" I found them ...
1 vote
1 answer
1k views

How to find out the PID which generates traffics to port 9229 in MacBook

There are unknown traffics to port 9229 in my MacBook. $ sudo tcpdump -i any -n port 9229 ...... 12:10:39.176502 IP6 ::1.62261 > ::1.9229: Flags [S], seq 638850191, win 65535, options [mss 16324,...
0 votes
0 answers
1k views

It is safe to kill every process running on a port?

This is my problem. I'm running a Node.JS API on a Debian server using Nodemon (Because I'm currently programming on my server) and that API is on a Apache Virtual Host using a reverse proxy. I use ...
3 votes
1 answer
2k views

UDP port appears in netstat but not in lsof?

After using Mosh, I noticed that UDP ports held by mosh-server were still in use after all processes exited. Running netstat -ln, it shows that these ports are in use: Active Internet connections ...
5 votes
2 answers
2k views

Find processes listening on the wildcard address in `lsof`

Using lsof, I can find all of the processes with a TCP socket listening for connections: lsof -Pni -sTCP:LISTEN e.g.: COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME cupsd 662 root ...
0 votes
1 answer
496 views

why the result of lsof | grep pid | wc -l and lsof -p pid |wc -l is different?

why the result of lsof | grep pid | wc -l and lsof -p pid |wc -l is different? the result of lsof -p | pid | wc -l is similar as ls /proc/pid/fd | wc -l, but the result of lsof | grep pid(or process ...
1 vote
0 answers
117 views

OS X Spell Service opens too many files?

I found this question, Is there a fix for the "Too many open files in system" error on OS X 10.7.1? , and specifically this answer https://superuser.com/a/1180084/177312 and the output ...
2 votes
2 answers
2k views

Mac lsof command find all processes for all users

A while ago my teacher asked me to create a script that would kill Minecraft anytime it came up. It worked when the user themselves ran it, but it didn't if it was at root level. Is there a command ...
5 votes
2 answers
23k views

Can't unmount dmg. Keep getting "Resource Busy"

"Workspace" is an encrypted dmg where I keep my code. I don't usually unmout it but I need to take a backup and it's refusing to let me unmount: mark@mark-macbook-air /Volumes$ lsof | grep Workspace ...
1 vote
2 answers
342 views

linux reverse engineer to find process source

A compromised wordpress site has started several processes that run as the apache user. I can find these processes by running ps and greping for the apache user. Then I take one of the process IDs and ...
2 votes
2 answers
4k views

Lsof command in repeat mode no interval

How can you set the timing of lsof to sub 1 second? On lsof -r (repeat mode), is the minimum value 1 second? Is there a way to have a continuous monitoring with lsof without having intervals between 2 ...
28 votes
3 answers
29k views

Continuously monitor files opened/accessed by a process

lsof -p 12345 will list all the files opened by process whose pid is 12345 but only for a particular instant of time. How can we continuously monitor a process from the start to end(until process is ...
2 votes
0 answers
324 views

lsof: restrict to sockets available via loopback

I can restrict the selection to sockets listening only on the loopback interface: $ lsof -p "$(pgrep -d, proga)" [email protected] -sTCP:LISTEN -P -n -a COMMAND PID USER FD TYPE DEVICE SIZE/OFF ...
1 vote
3 answers
3k views

My web server and web browser appear to be using port 80 at the same time

If I, on OS X, Start Firefox. Start Google Chrome. Start a Ruby on Rails server on port 80 (using RVM) rvmsudo rails -p 80 Use lsof to look at what is running on port 80 sudo lsof -i:80 Then I ...
1 vote
0 answers
194 views

Per-process network usage on OSX?

I want to periodically poll for per-process network usage. Is there a way to do this efficiently in OSX like netstat -p on Linux? I know there's lsof -i -Tqsf but it doesn't seem to show bytes sent/...
7 votes
2 answers
21k views

Debugging connection timeouts using strace?

I'm trying to figure out why is Eclipse spinning, so I decided to fire up strace. I found the eclipse process using: $ ps ax | grep java 5546 ? Sl 19:04 /usr/bin/java ... [arguments ...
2 votes
2 answers
3k views

Counting the number of open files for each user?

I am looking for a command that would list me number of open files for each user, sorted descending. For example lsof -u postgres | wc - would list them only for the postgres user, but I do want to ...
1 vote
1 answer
527 views

How can I check which computers I am logged onto on my school network?

At some point in the last week, I forgot to log out of a computer somewhere in my school and now I cannot open firefox because it is already open on that computer. Is there a shell command for me to ...
1 vote
1 answer
1k views

How can I get file names of opened by a process?

I want to list down all file names opened by init process. I know about /proc/PID/fd directory. But that gives file descriptors only. How can I get file names from list of file descriptors?
5 votes
2 answers
4k views

How can I print file names on linux command if know its file descriptor of a file opened by a process?

I know the file descriptor of a file opened by a process, but I don't know the process ID. How can I print file names from the Linux command prompt if I know the file descriptor of a file opened by a ...
1 vote
2 answers
2k views

What does *:* in lsof output stand for?

While executing the command /usr/sbin/lsof -l -i -P -n as the root user, I am getting this output. COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME ... httpd 9164 70 3u ...
1 vote
3 answers
3k views

mv: cannot move «file.mp4» to «/path/file.mp4»: Device or resource busy*

I simply try to move file to another path and I'm getting mv: cannot move «file.mp4» to «/path/file.mp4»: Device or resource busy* I've tried using lsof, but it's not showing any openfiles. lsof +D ...
7 votes
1 answer
3k views

lsof reports no files open on external volume but it still cannot be safely unmounted

I've searched around here on SX and other places but have not found an approach that gives me any traction on my issue. I've a volume (used by Time Machine as it happens) on an external Firewire ...
0 votes
1 answer
315 views

Better use of lsof in Linux?

I'm looking for a way to list open files by the Flash plugin (whether Firefox or Chrome). I could use lsof | grep Flash, and it works. But I'm looking for a more efficient way to do that, using lsof ...
2 votes
3 answers
17k views

Listing active *and past* network connections

On Linux, I know that I can list active network connections with lsof -i or netstat. However, as far as I know, this only list connections that are currently open. If a process makes a short ...
1 vote
1 answer
219 views

How to determine full command with args given a pid (or port in use)

I've got this nice bash function for telling me the pid using a port: using_port() { lsof -i:${1} } Output looks like this: COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME ...
4 votes
2 answers
795 views

How can I programmatically “eject” a keychain on OS X?

I'm using a script to eject a small USB key I use as a “identity” drive, which contains some secure information. Of note, it has an OS X “keychain” file on it, which contains some of my more secure ...
1 vote
1 answer
779 views

How can I unbind a UDP port that has no entry in lsof?

On my Mac, I have a UDP port that is "already in use", but doesn't have an associated process: sudo netstat -na | grep "udp.*\.500\>" shows udp4 0 0 192.168.50.181.500 *.* ...
4 votes
1 answer
5k views

How to install lsof on Debian/kFreeBSD?

How do you install lsof on Debian/kFreeBSD Testing (Wheezy/Sid)? $ apt-get install lsof Package lsof is not available, but is referred to by another package. This may mean that the package is missing,...
2 votes
1 answer
2k views

How to convert lsof hexadecimal IP:port output to decimal notation?

I feel dumb for asking but how do I convert this to the IP port combination? IPV4 0xffffff8015f9aa40
1 vote
1 answer
218 views

Why Does Issuing One lsof Launches Two Processes?

I'm on current OS X 10.7. Sometimes I want to check which application locks a certain file. I do that by lsof | grep $FILENAME I noticed that running this command invokes two instances of lsof. Why ...
2 votes
4 answers
3k views

How to move files that are not in use?

I want to move files in a directory that are not currently in use. I have a sense that some combination of lsof, find, and xargs could work but I can't quite get there. So far, I created the ...
2 votes
1 answer
1k views

Periodically printing the number of open files for a process

I can use a program like top to periodically update system statistics and I can use lsof -p <pid> | wc -l to give me a snapshot of the number open files for a process. Is there a command I can ...
1 vote
2 answers
2k views

How many files should be listed as open under lsof?

I am not an advanced Linux user. I have a VPS with 768MB of RAM running CentOS. I executed the lsof command as root and I see that there is a list of 3000 files. Usually, how many files should be ...
3 votes
1 answer
112 views

Is there a way to know WHEN a connection has been established?

I'm working with mobile IPv6 and was dealing with lots of zombie connections. I set keepAlive to true and want to test whether old connections are being discarded. I'm using lsof to list the process ...