The power of lsof

It seems so many people don’t know about the power of this simple little command. So here are a few commands I find useful all the time for troubleshooting problems.

socket files, add -N for nfs

lsof -U

user files/sockets open, can be added to any option

lsof -u id

list open files on a device or partition

lsof /dev/hda1
lsof /dev/mapper/rootvg-var_lv

files open by process

lsof -p <pid>
lsof -c <name of process>

connected with range of ports

lsof -i @

narrow network connections search by port, server or host.

lsof –i :587
lsof –i :smtp
lsof –i

Get current number of open file descriptors:

lsof [-p pid] | wc -l

How to recover an open file (say zone files).

This is useful if a file in use gets deleted. This is only useful if the file is still loaded into memory but can save you hours worth of work. It works by using the /proc file system. To see it in action do ps aux > myfile.

  1. lsof | grep myfile (less      23203      root    4r      REG      253,0   119620      65589 /root/myfile (deleted))
  2. The first column gives you the name of the command associated with the process, the second column is the process id, and the number in the fourth column is the file descriptor (the “r” means that it’s a regular file).
  3. cp /proc/23203/fd/4 myfile.saved
  4. check the file to see if it is correct

I may give more details on recovering files if there is more interest in it. That was just a quick and dirty.