It seems so many people don’t know about the power of this simple little command. So here are a few commands I find useful all the time for troubleshooting problems.
socket files, add -N for nfs
user files/sockets open, can be added to any option
lsof -u id
list open files on a device or partition
lsof /dev/hda1 lsof /dev/mapper/rootvg-var_lv
files open by process
lsof -p <pid> lsof -c <name of process>
connected with range of ports
lsof -i @192.168.0.101:1-1024
narrow network connections search by port, server or host.
lsof –i :587 lsof –i :smtp lsof –i @host.remote.net
Get current number of open file descriptors:
lsof [-p pid] | wc -l
How to recover an open file (say zone files).
This is useful if a file in use gets deleted. This is only useful if the file is still loaded into memory but can save you hours worth of work. It works by using the /proc file system. To see it in action do ps aux > myfile.
- lsof | grep myfile (less 23203 root 4r REG 253,0 119620 65589 /root/myfile (deleted))
- The first column gives you the name of the command associated with the process, the second column is the process id, and the number in the fourth column is the file descriptor (the “r” means that it’s a regular file).
- cp /proc/23203/fd/4 myfile.saved
- check the file to see if it is correct
I may give more details on recovering files if there is more interest in it. That was just a quick and dirty.