The lsof command or “list open files” command in Linux is a powerful tool. In Linux and Unix everything behind the scenes are just files. This includes IP sockets, pipes, unix sockets, directories, devices, even inodes are just files. This means that lsof can actually tell you a lot of information of what is going on on your system.
Synopsis
lsof [ -?abChlnNOPRstUvVX ] [ -A A ] [ -c c ] [ +|-d d ] [ +|-D D ] [ +|-f [cfgGn] ] [ -F [f] ] [ -g [s] ] [ -i [i] ] [ -k k ] [ +|-L [l] ] [ -m m ] [ +|-M ] [ -o [o] ] [ -p s ] [ +|-r [t] ] [ -S [t] ] [ -T [t] ] [ -u s ] [ +|-w ] [ -- ] [names]
Example 1: Show all opened files
Type the following command
lsof | more
Sample outputs
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME init 1 root cwd DIR 253,4 4096 2 / init 1 root rtd DIR 253,4 4096 2 / init 1 root txt REG 253,4 38652 41746599 /sbin/init init 1 root mem REG 253,4 129900 16252964 /lib/ld-2.5.so init 1 root mem REG 253,4 1693812 16252965 /lib/libc-2.5.so init 1 root mem REG 253,4 20668 16253168 /lib/libdl-2.5.so init 1 root mem REG 253,4 245376 16253222 /lib/libsepol.so.1 init 1 root mem REG 253,4 93508 16253815 /lib/libselinux.so.1 init 1 root 10u FIFO 0,17 1277 /dev/initctl ...
Example 2: Show all opened internet sockets
Using the -i flag lsof will list the internet sockets currently opened
lsof -i
Sample outputs
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME sshd 2537 root 3u IPv6 5348 TCP *:rockwell-csp2 (LISTEN) mysqld 2625 mysql 11u IPv4 5463 TCP *:mysql (LISTEN) httpd 2731 apache 3u IPv6 30048993 TCP *:http (LISTEN) ...
Example 3: Shows all networking related to a given port 80
lsof -i :80
Sample outputs
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME httpd 2731 apache 3u IPv6 30048993 TCP *:http (LISTEN) httpd 2731 apache 58u IPv6 39448263 TCP server.com:http->adsl-dynamic-pool-xxx.hcm.fpt.vn:23527 (ESTABLISHED) httpd 2731 apache 60u IPv6 39448302 TCP server.com:http->crawl-66-249-69-83.googlebot.com:35190 (ESTABLISHED) httpd 2731 apache 61u IPv6 39448336 TCP server.com:http->v16-13.opera-mini.net:37548 (ESTABLISHED) httpd 2731 apache 62u IPv6 39448388 TCP server.com:http->v16-13.opera-mini.net:37561 (ESTABLISHED) httpd 2731 apache 64u IPv6 39447543 TCP server.com:http->adsl.viettel.vn:13636 (FIN_WAIT2)
Example 4: Show all TCP/UDP connections
lsof -i TCP
Sample outputs
sshd 2537 root 3u IPv6 5348 TCP *:rockwell-csp2 (LISTEN) mysqld 2625 mysql 11u IPv4 5463 TCP *:mysql (LISTEN) httpd 2731 apache 3u IPv6 30048993 TCP *:http (LISTEN) ...
Example 5: List open files associated with process ID
The flag +p will display all open files associated with specific process ID, example with process ID is 2625
lsof +p 2625
Sample outputs
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME mysqld 2625 mysql cwd DIR 253,4 4096 21495811 /var/lib/mysql mysqld 2625 mysql rtd DIR 253,4 4096 2 / mysqld 2625 mysql txt REG 253,4 7020300 50999198 /usr/libexec/mysqld mysqld 2625 mysql DEL REG 253,4 16253135 /lib/libcrypto.so.0.9.8e.#prelink#.64u8kX mysqld 2625 mysql mem REG 253,4 16252984 /lib/libm-2.5.so (path inode=16253122) mysqld 2625 mysql DEL REG 253,4 50996047 /usr/lib/libgssapi_krb5.so.2.2.#prelink#.YYIHuy mysqld 2625 mysql mem REG 253,4 16252990 /lib/libselinux.so.1 (path inode=16253815) mysqld 2625 mysql mem REG 253,4 16256252 /lib/libsepol.so.1 (path inode=16253222) mysqld 2625 mysql mem REG 253,4 50848 16253138 /lib/libnss_files-2.5.so mysqld 2625 mysql mem REG 253,4 16253825 /lib/librt-2.5.so (path inode=16253220) mysqld 2625 mysql mem REG 253,4 16252942 /lib/ld-2.5.so (path inode=16252964) mysqld 2625 mysql mem REG 253,4 50996107 /usr/lib/libstdc++.so.6.0.8 (path inode=50989584) mysqld 2625 mysql mem REG 253,4 50996061 /usr/lib/libkrb5.so.3.3 (path inode=50999803) mysqld 2625 mysql mem REG 253,4 16252980 /lib/libdl-2.5.so (path inode=16253168) ...
Example 6: Show what a given user has open
The flag -u will show what a given user has open
lsof -u apache
Sample outputs
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME httpd 2731 apache cwd DIR 253,4 4096 2 / httpd 2731 apache rtd DIR 253,4 4096 2 / httpd 2731 apache txt REG 253,4 3120954 51157630 /usr/local/apache/bin/httpd httpd 2731 apache mem REG 253,4 375710 51157607 /usr/local/apache/lib/libaprutil-1.so.0.3.10 httpd 2731 apache mem REG 253,4 45432 16253184 /lib/libcrypt-2.5.so httpd 2731 apache mem REG 253,4 7748 16253849 /lib/libcom_err.so.2.1 httpd 2731 apache mem REG 253,4 7880 16253845 /lib/libkeyutils-1.2.so httpd 2731 apache mem REG 253,4 937178 51157689 /usr/local/apache/modules/mod_security2.so httpd 2731 apache mem REG 253,4 129208 16253851 /lib/libpcre.so.0.0.1 ...
Pages: 1 2
Related Posts:
- Linux Shutdown Command
- How To Kill Process In Linux
- How To Find Hard Drive Specifications
- How To Install Ksplice on CentOS / RedHat
- How To Update Linux Kernel With Ksplice Uptrack
- Repel port flood by CSF and IPT_Recent
- How Do I Block An IP Address On Linux Server ?
- How To Flush The Entire Contents Of Memcache Server
- How To Extract RAR Files Under Linux
- Linux Password Protect Files