只需輸入 lsof 就可以生成大量的信息,因為 lsof 需要訪問核心內存和各種 文件,所以必須以 root 用戶的身份運行它才能夠充分地發揮其功能。
lsof 的示例輸出:
root@YLinux:~/lab 0# lsof COMMAND PID TID USER FD TYPE DEVICE SIZE/OFF NODE NAME systemd 1 root cwd DIR 8,6 4096 2 / systemd 1 root rtd DIR 8,6 4096 2 / systemd 1 root txt REG 8,6 2273340 1834909 /usr/lib/systemd/systemd systemd 1 root mem REG 8,6 210473 1700647 /lib/libnss_files-2.15.s ...
查看文件被哪些進程佔用
# lsof /dev/tty1 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME bash 1770 jian 0u CHR 4,1 0t0 1045 /dev/tty1 bash 1770 jian 1u CHR 4,1 0t0 1045 /dev/tty1 bash 1770 jian 2u CHR 4,1 0t0 1045 /dev/tty1 bash 1770 jian 255u CHR 4,1 0t0 1045 /dev/tty1 startx 1845 jian 0u CHR 4,1 0t0 1045 /dev/tty1 startx 1845 jian 1u CHR 4,1 0t0 1045 /dev/tty1 ...
指定目錄,可以看到有哪些進程打開了其下的文件:
# lsof /data/ COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME bash 15983 jian cwd DIR 8,5 4096 8252 /data/backup ...
這在 umount 某個文件系統失敗時非常有用。
指定進程號,可以查看該進程打開的文件:
# lsof -p 2064 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME firefox 2064 jian cwd DIR 8,6 4096 1571780 /home/jian firefox 2064 jian rtd DIR 8,6 4096 2 / firefox 2064 jian txt REG 8,6 44224 1985670 /usr/lib/firefox-12.0/firefox firefox 2064 jian mem REG 8,6 14707012 925361 /usr/share/fonts/chinese/msyhbd.ttf firefox 2064 jian mem REG 8,6 15067744 925362 /usr/share/fonts/chinese/msyh.ttf firefox 2064 jian mem REG 8,6 16791251 1701681 /usr/share/fonts/wenquanyi/wqy-zenhei.ttc firefox 2064 jian mem REG 0,16 67108904 10203 /dev/shm/pulse-shm-3021850167 ...
查看指定埠有哪些進程在使用:
# lsof -i:22 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME sshd 1569 root 3u IPv4 10303 0t0 TCP *:ssh (LISTEN) sshd 1569 root 4u IPv6 10305 0t0 TCP *:ssh (LISTEN) ...
查看指定網口有哪些進程在使用:
# lsof -i@192.168.1.91 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME skype 1909 jian 54u IPv4 9116 0t0 TCP 192.168.1.91:40640->64.4.23.153:40047 (ESTABLISHED) pidgin 1973 jian 7u IPv4 6599 0t0 TCP 192.168.1.91:59311->hx-in-f125.1e100.net:https (ESTABLISHED) pidgin 1973 jian 13u IPv4 9260 0t0 TCP 192.168.1.91:54447->by2msg3010511.phx.gbl:msnp (ESTABLISHED) ...
查看指定用?舸蚩?奈募??/p>
# lsof -u messagebus COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME dbus-daem 1805 messagebus cwd DIR 8,6 4096 2 / dbus-daem 1805 messagebus rtd DIR 8,6 4096 2 / dbus-daem 1805 messagebus txt REG 8,6 1235361 1834948 /usr/bin/dbus-daemon dbus-daem 1805 messagebus mem REG 8,6 210473 1700647 /lib/libnss_files-2.15.so dbus-daem 1805 messagebus mem REG 8,6 190145 1700642 /lib/libnss_nis-2.15.so dbus-daem 1805 messagebus mem REG 8,6 490366 1700636 /lib/libnsl-2.15.so ...
查看指定程序打開的文件:
# lsof -c firefox COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME firefox 2064 jian cwd DIR 8,6 4096 1571780 /home/jian firefox 2064 jian rtd DIR 8,6 4096 2 / firefox 2064 jian txt REG 8,6 44224 1985670 /usr/lib/firefox-12.0/firefox firefox 2064 jian mem REG 8,6 14707012 925361 /usr/share/fonts/chinese/msyhbd.ttf firefox 2064 jian mem REG 8,6 15067744 925362 /usr/share/fonts/chinese/msyh.ttf firefox 2064 jian mem REG 8,6 16791251 1701681 /usr/share/fonts/wenquanyi/wqy-zenhei.ttc ...
只有多個查詢條件都滿足, 用 "-a" 參數。
# lsof -a -c bash -u root COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME bash 1986 root cwd DIR 8,6 4096 1701593 /root/lab bash 1986 root rtd DIR 8,6 4096 2 / bash 1986 root txt REG 8,6 1994157 1700632 /bin/bash bash 1986 root mem REG 8,6 9690800 405214 /usr/lib/locale/locale-archive bash 1986 root mem REG 8,6 210473 1700647 /lib/libnss_files-2.15.so
via http://www.ylinux.org/forum/t/276
[火星人 ] 實用的系統工具之 lsof已經有564次圍觀