The lsof command or “list open files” command in Linux is a powerful tool. In Linux and Unix everything behind the scenes are just files. This includes IP sockets, pipes, unix sockets, directories, devices, even inodes are just files. This means that lsof can actually tell you a lot of information of what is going on on your system.

Synopsis

lsof [ -?abChlnNOPRstUvVX ] [ -A A ] [ -c c ] [ +|-d d ] [ +|-D D ] [ +|-f [cfgGn] ] [ -F [f] ] [ -g [s] ] [ -i [i] ] [ -k k ] [ +|-L [l] ] [ -m m ] [ +|-M ] [ -o [o] ] [ -p s ] [ +|-r [t] ] [ -S [t] ] [ -T [t] ] [ -u s ] [ +|-w ] [ -- ] [names] 

Example 1: Show all opened files

Type the following command

lsof | more

Sample outputs

COMMAND     PID      USER   FD      TYPE     DEVICE      SIZE       NODE NAME
init          1      root  cwd       DIR      253,4      4096          2 /
init          1      root  rtd       DIR      253,4      4096          2 /
init          1      root  txt       REG      253,4     38652   41746599 /sbin/init
init          1      root  mem       REG      253,4    129900   16252964 /lib/ld-2.5.so
init          1      root  mem       REG      253,4   1693812   16252965 /lib/libc-2.5.so
init          1      root  mem       REG      253,4     20668   16253168 /lib/libdl-2.5.so
init          1      root  mem       REG      253,4    245376   16253222 /lib/libsepol.so.1
init          1      root  mem       REG      253,4     93508   16253815 /lib/libselinux.so.1
init          1      root   10u     FIFO       0,17                 1277 /dev/initctl
...

Example 2: Show all opened internet sockets

Using the -i flag lsof will list the internet sockets currently opened

lsof -i

Sample outputs

COMMAND     PID   USER   FD   TYPE   DEVICE SIZE NODE NAME
sshd       2537   root    3u  IPv6     5348       TCP *:rockwell-csp2 (LISTEN)
mysqld     2625  mysql   11u  IPv4     5463       TCP *:mysql (LISTEN)
httpd      2731 apache    3u  IPv6 30048993       TCP *:http (LISTEN)
...

Example 3: Shows all networking related to a given port 80

lsof -i :80

Sample outputs

COMMAND   PID   USER   FD   TYPE   DEVICE SIZE NODE NAME
httpd    2731 apache    3u  IPv6 30048993       TCP *:http (LISTEN)
httpd    2731 apache   58u  IPv6 39448263       TCP server.com:http->adsl-dynamic-pool-xxx.hcm.fpt.vn:23527 (ESTABLISHED)
httpd    2731 apache   60u  IPv6 39448302       TCP server.com:http->crawl-66-249-69-83.googlebot.com:35190 (ESTABLISHED)
httpd    2731 apache   61u  IPv6 39448336       TCP server.com:http->v16-13.opera-mini.net:37548 (ESTABLISHED)
httpd    2731 apache   62u  IPv6 39448388       TCP server.com:http->v16-13.opera-mini.net:37561 (ESTABLISHED)
httpd    2731 apache   64u  IPv6 39447543       TCP server.com:http->adsl.viettel.vn:13636 (FIN_WAIT2)

Example 4: Show all TCP/UDP connections

lsof -i TCP

Sample outputs

sshd       2537   root    3u  IPv6     5348       TCP *:rockwell-csp2 (LISTEN)
mysqld     2625  mysql   11u  IPv4     5463       TCP *:mysql (LISTEN)
httpd      2731 apache    3u  IPv6 30048993       TCP *:http (LISTEN)
...

Example 5: List open files associated with process ID

The flag +p will display all open files associated with specific process ID, example with process ID is 2625

lsof +p 2625

Sample outputs

COMMAND  PID  USER   FD   TYPE     DEVICE      SIZE     NODE NAME
mysqld  2625 mysql  cwd    DIR      253,4      4096 21495811 /var/lib/mysql
mysqld  2625 mysql  rtd    DIR      253,4      4096        2 /
mysqld  2625 mysql  txt    REG      253,4   7020300 50999198 /usr/libexec/mysqld
mysqld  2625 mysql  DEL    REG      253,4           16253135 /lib/libcrypto.so.0.9.8e.#prelink#.64u8kX
mysqld  2625 mysql  mem    REG      253,4           16252984 /lib/libm-2.5.so (path inode=16253122)
mysqld  2625 mysql  DEL    REG      253,4           50996047 /usr/lib/libgssapi_krb5.so.2.2.#prelink#.YYIHuy
mysqld  2625 mysql  mem    REG      253,4           16252990 /lib/libselinux.so.1 (path inode=16253815)
mysqld  2625 mysql  mem    REG      253,4           16256252 /lib/libsepol.so.1 (path inode=16253222)
mysqld  2625 mysql  mem    REG      253,4     50848 16253138 /lib/libnss_files-2.5.so
mysqld  2625 mysql  mem    REG      253,4           16253825 /lib/librt-2.5.so (path inode=16253220)
mysqld  2625 mysql  mem    REG      253,4           16252942 /lib/ld-2.5.so (path inode=16252964)
mysqld  2625 mysql  mem    REG      253,4           50996107 /usr/lib/libstdc++.so.6.0.8 (path inode=50989584)
mysqld  2625 mysql  mem    REG      253,4           50996061 /usr/lib/libkrb5.so.3.3 (path inode=50999803)
mysqld  2625 mysql  mem    REG      253,4           16252980 /lib/libdl-2.5.so (path inode=16253168)
...

Example 6: Show what a given user has open

The flag -u will show what a given user has open

lsof -u apache

Sample outputs

COMMAND   PID   USER   FD   TYPE     DEVICE      SIZE     NODE NAME
httpd    2731 apache  cwd    DIR      253,4      4096        2 /
httpd    2731 apache  rtd    DIR      253,4      4096        2 /
httpd    2731 apache  txt    REG      253,4   3120954 51157630 /usr/local/apache/bin/httpd
httpd    2731 apache  mem    REG      253,4    375710 51157607 /usr/local/apache/lib/libaprutil-1.so.0.3.10
httpd    2731 apache  mem    REG      253,4     45432 16253184 /lib/libcrypt-2.5.so
httpd    2731 apache  mem    REG      253,4      7748 16253849 /lib/libcom_err.so.2.1
httpd    2731 apache  mem    REG      253,4      7880 16253845 /lib/libkeyutils-1.2.so
httpd    2731 apache  mem    REG      253,4    937178 51157689 /usr/local/apache/modules/mod_security2.so
httpd    2731 apache  mem    REG      253,4    129208 16253851 /lib/libpcre.so.0.0.1
...

The post 10 lsof Command Examples appeared first on lifeLinux: Linux Tips, Hacks, Tutorials, Ebooks.

Find files larger than a certain size

This example finds all the files under /root directory which are larger than 50k

[root@lifelinux ~]# find /root -size +50k

Sample output

/root/ioncube/ioncube_loader_lin_5.3_ts.so
/root/ioncube/ioncube_loader_lin_4.1.so
/root/ioncube/ioncube_loader_lin_5.1.so
/root/ioncube/ioncube_loader_lin_4.2.so
...

Find files within specified size limits

Example, type the following command to limit the search to find only files with the size of 50k to 100k

[root@lifelinux ~]# find /var/log -size +50k -size -100k

Sample output

/var/log/secure.2
/var/log/munin/munin-node.log
/var/log/munin/munin-limits.log
...

If you want to list them with ls, type the following command

[root@lifelinux ~]# find /var/log -size +50k -size -100k -exec ls -lha {} \;

Sample output

-rw------- 1 root root 59K Apr 30 22:01 /var/log/secure.2
-rw-r--r-- 1 root root 54K May 13 23:05 /var/log/munin/munin-node.log
-rw-r--r-- 1 munin munin 94K May 13 23:05 /var/log/munin/munin-limits.log

Further readings

Find command

The post Find Large Files In Linux appeared first on lifeLinux: Linux Tips, Hacks, Tutorials, Ebooks.

What are the SUID, SGID and the Sticky Bits?

Sticky Bit

Lets start with Sticky bit first. Since this is the most simplest to explain. Setting the sticky bit tells Unix that once the concerned application is executed, it should remain in memory. Remember that Unix is a multi-user OS and was mainly designed so that multiple users can work simultaneously. Thus the logic used is that a program that exists in memory requires lesser time to start when a new user requests for the same program. Thus when one user has just used a program and then a new user wants to use the same program, the second user doesn’t have to face a time delay for the program to initialize itself. It would be readily available to him. The concept of the sticky bit was a very useful one, long back when fast disk access and other memory access technologies weren’t around. But in today’s age the concept of sticky bit is obsolete, since modern day technology is advanced enough to reduce the time delay while loading applications into the memory. Thus currently the sticky bit is of very little significance. Sticky bit is only associated with executables.

SUID (Set User ID) Bit

Sometime you may faced an error while trying to run any application stating that the application must be ‘SUID root’ . You might have been confused that time, but now once you read this article you would no longer find it confusing.

SUID stands for Set User ID. This means that if the SUID bit is set for any application then your user ID would be set as that of the owner of application/file rather than the current user, while running that application. That means in case I have an application whose owner is ‘ root ‘ and it has its SUID bit set, then when I run this application as a normal user, that application would still run as root. Since the SUID bit tells Linux that the the User ID root is set for this application and whenever this application executes it must execute as if root was executing it (since root owns this file).

SGID (Set Group ID) bit

Just like SUID, setting the SGID bit for a file sets your group ID to the file’s group while the file is executing. IT is really useful in case you have a real multi-user setup where users access each others files. As a single homeuser I haven’t really found a lot of use for SGID. But the basic concept is the same as the SUID, the files whose SGID bit are set would be used as if they belong to that group rather than to that user alone.

Setting the SUID/SGID bits

Setting SUID bits on the file:
Suppose I got the executable called “killprocess” and I need to set the suid bit on this file, go to command prompt and issue command:

chmod u+s filename

Now check permission on the file with command

ls -l filename

Observe “s” that has been added for suid bit

-rwsr-xr-x 1 root root 8 Jun  8 10:10 filename

Setting GUID bits on the file:
Go to command prompt and issue command:

chmod g+s filename

This will set the GUID bit on the same file, check the permission on this file using command:

ls -l filename

-rwsr-sr-x 1 root root 8 Jun  8 12:11 filename

Setting Sticky bits on the folder:

chmod +t folder

Find SUID/SGID files

Find all SUID root files:

find / -user root -perm -4000 -print

Find all SGID root files:

find / -group root -perm -2000 -print

Find all SUID and SGID files owned by anyone:

find / -perm -4000 -o -perm -2000 -print

The post SUID, SGID and Sticky Bits appeared first on lifeLinux: Linux Tips, Hacks, Tutorials, Ebooks.