1LSOF(1) General Commands Manual LSOF(1)
2
6 lsof - list open files
7
9 lsof [ -?abChlnNOPQRtUvVX ] [ -A A ] [ -c c ] [ +c c ] [ +|-d d ] [
10 +|-D D ] [ +|-e s ] [ +|-E ] [ +|-f [cfgGn] ] [ -F [f] ] [ -g [s] ] [
11 -i [i] ] [ -k k ] [ -K k ] [ +|-L [l] ] [ +|-m m ] [ +|-M ] [ -o [o] ]
12 [ -p s ] [ +|-r [t[m<fmt>]] ] [ -s [p:s] ] [ -S [t] ] [ -T [t] ] [ -u s
13 ] [ +|-w ] [ -x [fl] ] [ -z [z] ] [ -Z [Z] ] [ -- ] [names]
14
16 Lsof revision 4.96.3 lists on its standard output file information
17 about files opened by processes for the following UNIX dialects:
18 Apple Darwin 9 and Mac OS X 10.[567]
20 FreeBSD 8.[234], 9.0 and 1[012].0 for AMD64-based systems
21 Linux 2.1.72 and above for x86-based systems
22 Solaris 9, 10 and 11
23 (See the DISTRIBUTION section of this manual page for information on
25 how to obtain the latest lsof revision.)
26 An open file may be a regular file, a directory, a block special file,
28 a character special file, an executing text reference, a library, a
29 stream or a network file (Internet socket, NFS file or UNIX domain
30 socket.) A specific file or all the files in a file system may be se‐
31 lected by path.
32 Instead of a formatted display, lsof will produce output that can be
34 parsed by other programs. See the -F, option description, and the OUT‐
35 PUT FOR OTHER PROGRAMS section for more information.
36 In addition to producing a single output list, lsof will run in repeat
38 mode. In repeat mode it will produce output, delay, then repeat the
39 output operation until stopped with an interrupt or quit signal. See
40 the +|-r [t[m<fmt>]] option description for more information.
41
43 In the absence of any options, lsof lists all open files belonging to
44 all active processes.
45 If any list request option is specified, other list requests must be
47 specifically requested - e.g., if -U is specified for the listing of
48 UNIX socket files, NFS files won't be listed unless -N is also speci‐
49 fied; or if a user list is specified with the -u option, UNIX domain
50 socket files, belonging to users not in the list, won't be listed un‐
51 less the -U option is also specified.
52 Normally, list options that are specifically stated are ORed - i.e.,
54 specifying the -i option without an address and the -ufoo option pro‐
55 duces a listing of all network files OR files belonging to processes
56 owned by user ``foo''. The exceptions are:
57 1) the `^' (negated) login name or user ID (UID), specified with the -u
59 option;
60 2) the `^' (negated) process ID (PID), specified with the -p option;
62 3) the `^' (negated) process group ID (PGID), specified with the -g op‐
64 tion;
65 4) the `^' (negated) command, specified with the -c option;
67 5) the (`^') negated TCP or UDP protocol state names, specified with
69 the -s [p:s] option.
70 Since they represent exclusions, they are applied without ORing or AND‐
72 ing and take effect before any other selection criteria are applied.
73 The -a option may be used to AND the selections. For example, specify‐
75 ing -a, -U, and -ufoo produces a listing of only UNIX socket files that
76 belong to processes owned by user ``foo''.
77 Caution: the -a option causes all list selection options to be ANDed;
79 it can't be used to cause ANDing of selected pairs of selection options
80 by placing it between them, even though its placement there is accept‐
81 able. Wherever -a is placed, it causes the ANDing of all selection op‐
82 tions.
83 Items of the same selection set - command names, file descriptors, net‐
85 work addresses, process identifiers, user identifiers, zone names, se‐
86 curity contexts - are joined in a single ORed set and applied before
87 the result participates in ANDing. Thus, for example, specifying
88 -i@aaa.bbb, -i@ccc.ddd, -a, and -ufff,ggg will select the listing of
89 files that belong to either login ``fff'' OR ``ggg'' AND have network
90 connections to either host aaa.bbb OR ccc.ddd.
91 Options may be grouped together following a single prefix -- e.g., the
93 option set ``-a -b -C'' may be stated as -abC. However, since values
94 are optional following +|-f, -F, -g, -i, +|-L, -o, +|-r, -s, -S, -T, -x
95 and -z. when you have no values for them be careful that the following
96 character isn't ambiguous. For example, -Fn might represent the -F and
97 -n options, or it might represent the n field identifier character fol‐
98 lowing the -F option. When ambiguity is possible, start a new option
99 with a `-' character - e.g., ``-F -n''. If the next option is a file
100 name, follow the possibly ambiguous option with ``--'' - e.g., ``-F --
101 name''.
102 Either the `+' or the `-' prefix may be applied to a group of options.
104 Options that don't take on separate meanings for each prefix - e.g., -i
105 - may be grouped under either prefix. Thus, for example, ``+M -i'' may
106 be stated as ``+Mi'' and the group means the same as the separate op‐
107 tions. Be careful of prefix grouping when one or more options in the
108 group does take on separate meanings under different prefixes - e.g.,
109 +|-M; ``-iM'' is not the same request as ``-i +M''. When in doubt, use
110 separate options with appropriate prefixes.
111 -? -h These two equivalent options select a usage (help) output
113 list. Lsof displays a shortened form of this output when it
114 detects an error in the options supplied to it, after it has
115 displayed messages explaining each error. (Escape the `?'
116 character as your shell requires.)
117 -a causes list selection options to be ANDed, as described above.
119 -A A is available on systems configured for AFS whose AFS kernel
121 code is implemented via dynamic modules. It allows the lsof
122 user to specify A as an alternate name list file where the
123 kernel addresses of the dynamic modules might be found. See
124 the lsof FAQ (The FAQ section gives its location.) for more
125 information about dynamic modules, their symbols, and how they
126 affect lsof.
127 -b causes lsof to avoid kernel functions that might block -
129 lstat(2), readlink(2), and stat(2).
130 See the BLOCKS AND TIMEOUTS and AVOIDING KERNEL BLOCKS sec‐
132 tions for information on using this option.
133 -c c selects the listing of files for processes executing the com‐
135 mand that begins with the characters of c. Multiple commands
136 may be specified, using multiple -c options. They are joined
137 in a single ORed set before participating in AND option selec‐
138 tion.
139 If c begins with a `^', then the following characters specify
141 a command name whose processes are to be ignored (excluded.)
142 If c begins and ends with a slash ('/'), the characters be‐
144 tween the slashes are interpreted as a regular expression.
145 Shell meta-characters in the regular expression must be quoted
146 to prevent their interpretation by the shell. The closing
147 slash may be followed by these modifiers:
148 b the regular expression is a basic one.
150 i ignore the case of letters.
151 x the regular expression is an extended one
152 (default).
153 See the lsof FAQ (The FAQ section gives its location.) for
155 more information on basic and extended regular expressions.
156 The simple command specification is tested first. If that
158 test fails, the command regular expression is applied. If the
159 simple command test succeeds, the command regular expression
160 test isn't made. This may result in ``no command found for
161 regex:'' messages when lsof's -V option is specified.
162 +c w defines the maximum number of initial characters of the name,
164 supplied by the UNIX dialect, of the UNIX command associated
165 with a process to be printed in the COMMAND column. (The lsof
166 default is nine.)
167 Note that many UNIX dialects do not supply all command name
169 characters to lsof in the files and structures from which lsof
170 obtains command name. Often dialects limit the number of
171 characters supplied in those sources. For example, Linux
172 2.4.27 and Solaris 9 both limit command name length to 16
173 characters.
174 If w is zero ('0'), all command characters supplied to lsof by
176 the UNIX dialect will be printed.
177 If w is less than the length of the column title, ``COMMAND'',
179 it will be raised to that length.
180 -C disables the reporting of any path name components from the
182 kernel's name cache. See the KERNEL NAME CACHE section for
183 more information.
184 +d s causes lsof to search for all open instances of directory s
186 and the files and directories it contains at its top level.
187 +d does NOT descend the directory tree, rooted at s. The +D D
188 option may be used to request a full-descent directory tree
189 search, rooted at directory D.
190 Processing of the +d option does not follow symbolic links
192 within s unless the -x or -x l option is also specified. Nor
193 does it search for open files on file system mount points on
194 subdirectories of s unless the -x or -x f option is also
195 specified.
196 Note: the authority of the user of this option limits it to
198 searching for files that the user has permission to examine
199 with the system stat(2) function.
200 -d s specifies a list of file descriptors (FDs) to exclude from or
202 include in the output listing. The file descriptors are spec‐
203 ified in the comma-separated set s - e.g., ``cwd,1,3'',
204 ``^6,^2''. (There should be no spaces in the set.)
205 The list is an exclusion list if all entries of the set begin
207 with `^'. It is an inclusion list if no entry begins with
208 `^'. Mixed lists are not permitted.
209 A file descriptor number range may be in the set as long as
211 neither member is empty, both members are numbers, and the
212 ending member is larger than the starting one - e.g., ``0-7''
213 or ``3-10''. Ranges may be specified for exclusion if they
214 have the `^' prefix - e.g., ``^0-7'' excludes all file de‐
215 scriptors 0 through 7.
216 Multiple file descriptor numbers are joined in a single ORed
218 set before participating in AND option selection.
219 When there are exclusion and inclusion members in the set,
221 lsof reports them as errors and exits with a non-zero return
222 code.
223 See the description of File Descriptor (FD) output values in
225 the OUTPUT section for more information on file descriptor
226 names.
227 fd is a pseudo file descriptor name for specifying the whole
229 range of possible file descriptor numbers. fd does not appear
230 in FD column of output.
231 +D D causes lsof to search for all open instances of directory D
233 and all the files and directories it contains to its complete
234 depth.
235 Processing of the +D option does not follow symbolic links
237 within D unless the -x or -x l option is also specified. Nor
238 does it search for open files on file system mount points on
239 subdirectories of D unless the -x or -x f option is also
240 specified.
241 Note: the authority of the user of this option limits it to
243 searching for files that the user has permission to examine
244 with the system stat(2) function.
245 Further note: lsof may process this option slowly and require
247 a large amount of dynamic memory to do it. This is because it
248 must descend the entire directory tree, rooted at D, calling
249 stat(2) for each file and directory, building a list of all
250 the files it finds, and searching that list for a match with
251 every open file. When directory D is large, these steps can
252 take a long time, so use this option prudently.
253 -D D directs lsof's use of the device cache file. The use of this
255 option is sometimes restricted. See the DEVICE CACHE FILE
256 section and the sections that follow it for more information
257 on this option.
258 -D must be followed by a function letter; the function letter
260 may optionally be followed by a path name. Lsof recognizes
261 these function letters:
262 ? - report device cache file paths
264 b - build the device cache file
265 i - ignore the device cache file
266 r - read the device cache file
267 u - read and update the device cache file
268 The b, r, and u functions, accompanied by a path name, are
270 sometimes restricted. When these functions are restricted,
271 they will not appear in the description of the -D option that
272 accompanies -h or -? option output. See the DEVICE CACHE
273 FILE section and the sections that follow it for more informa‐
274 tion on these functions and when they're restricted.
275 The ? function reports the read-only and write paths that
277 lsof can use for the device cache file, the names of any envi‐
278 ronment variables whose values lsof will examine when forming
279 the device cache file path, and the format for the personal
280 device cache file path. (Escape the `?' character as your
281 shell requires.)
282 When available, the b, r, and u functions may be followed by
284 the device cache file's path. The standard default is
285 .lsof_hostname in the home directory of the real user ID that
286 executes lsof, but this could have been changed when lsof was
287 configured and compiled. (The output of the -h and -? op‐
288 tions show the current default prefix - e.g., ``.lsof''.) The
289 suffix, hostname, is the first component of the host's name
290 returned by gethostname(2).
291 When available, the b function directs lsof to build a new de‐
293 vice cache file at the default or specified path.
294 The i function directs lsof to ignore the default device cache
296 file and obtain its information about devices via direct calls
297 to the kernel.
298 The r function directs lsof to read the device cache at the
300 default or specified path, but prevents it from creating a new
301 device cache file when none exists or the existing one is im‐
302 properly structured. The r function, when specified without a
303 path name, prevents lsof from updating an incorrect or out‐
304 dated device cache file, or creating a new one in its place.
305 The r function is always available when it is specified with‐
306 out a path name argument; it may be restricted by the permis‐
307 sions of the lsof process.
308 When available, the u function directs lsof to read the device
310 cache file at the default or specified path, if possible, and
311 to rebuild it, if necessary. This is the default device cache
312 file function when no -D option has been specified.
313 +|-e s exempts the file system whose path name is s from being sub‐
315 jected to kernel function calls that might block. The +e op‐
316 tion exempts stat(2), lstat(2) and most readlink(2) kernel
317 function calls. The -e option exempts only stat(2) and
318 lstat(2) kernel function calls. Multiple file systems may be
319 specified with separate +|-e specifications and each may have
320 readlink(2) calls exempted or not.
321 This option is currently implemented only for Linux.
323 CAUTION: this option can easily be mis-applied to other than
325 the file system of interest, because it uses path name rather
326 than the more reliable device and inode numbers. (Device and
327 inode numbers are acquired via the potentially blocking
328 stat(2) kernel call and are thus not available, but see the
329 +|-m m option as a possible alternative way to supply device
330 numbers.) Use this option with great care and fully specify
331 the path name of the file system to be exempted.
332 When open files on exempted file systems are reported, it may
334 not be possible to obtain all their information. Therefore,
335 some information columns will be blank, the characters
336 ``UNKN'' preface the values in the TYPE column, and the appli‐
337 cable exemption option is added in parentheses to the end of
338 the NAME column. (Some device number information might be
339 made available via the +|-m m option.)
340 +|-E +E specifies that Linux pipe, Linux UNIX socket, Linux INET(6)
342 socket closed in a local host, Linux pseudoterminal files,
343 POSIX Message Queueue implementation in Linux, and Linux
344 eventfd should be displayed with endpoint information and the
345 files of the endpoints should also be displayed.
346 Note 1: UNIX socket file endpoint information is only avail‐
348 able when the compile flags line of -v output contains HASUX‐
349 SOCKEPT, and psudoterminal endpoint information is only avail‐
350 able when the compile flags line contains HASPTYEPT.
351 Note 2: POSIX Message Queue file endpoint information is only
353 available when mqueue file system is mounted.
354 Pipe endpoint information is displayed in the NAME column in
356 the form ``PID,cmd,FDmode'', where PID is the endpoint process
357 ID; cmd is the endpoint process command; FD is the endpoint
358 file's descriptor; and mode is the endpoint file's access
359 mode.
360 Pseudoterminal endpoint information is displayed in the NAME
362 column as ``->/dev/ptsmin PID,cmd,FDmode'' or ``PID,cmd,FD‐
363 mode''. The first form is for a master device; the second,
364 for a slave device. min is a slave device's minor device num‐
365 ber; and PID, cmd, FD and mode are the same as with pipe end‐
366 point information. Note: psudoterminal endpoint information
367 is only available when the compile flags line of -V output
368 contains HASPTYEPT. In addition, this feature works on Linux
369 kernels above 4.13.0.
370 UNIX socket file endpoint information is displayed in the NAME
372 column in the form
373 ``type=TYPE ->INO=INODE PID,cmd,FDmode'', where TYPE is the
374 socket type; INODE is the i-node number of the connected
375 socket; and PID, cmd, FD and mode are the same as with pipe
376 endpoint information. Note: UNIX socket file endpoint infor‐
377 mation is available only when the compile flags line of -v
378 output contains HASUXSOCKEPT.
379 INET socket file endpoint information is inserted to the value
381 at the NAME column in th form
382 PID, cmd, FD and mode are the same as with pipe endpoint in‐
383 formation. The endpoint information is available only if the
384 socket is used for local IPC; both endpoints bind to the same
385 local IPv4 or IPv6 address.
386 POSIX Message Queue file endpoint information is displayed in
388 the NAME column in the same form as that of pipe.
389 eventfd endpoint information is displayed in the NAME column
391 in the same form as that of pipe. This feature works on Linux
392 kernels above 5.2.0.
393 Multiple occurrences of this information can appear in a
395 file's NAME column.
396 -E specifies that endpoint supported files should be displayed
398 with endpoint information, but not the files of the endpoints.
399 +|-f [cfgGn]
401 f by itself clarifies how path name arguments are to be inter‐
402 preted. When followed by c, f, g, G, or n in any combination
403 it specifies that the listing of kernel file structure infor‐
404 mation is to be enabled (`+') or inhibited (`-').
405 Normally a path name argument is taken to be a file system
407 name if it matches a mounted-on directory name reported by
408 mount(8), or if it represents a block device, named in the
409 mount output and associated with a mounted directory name.
410 When +f is specified, all path name arguments will be taken to
411 be file system names, and lsof will complain if any are not.
412 This can be useful, for example, when the file system name
413 (mounted-on device) isn't a block device. This happens for
414 some CD-ROM file systems.
415 When -f is specified by itself, all path name arguments will
417 be taken to be simple files. Thus, for example, the ``-f --
418 /'' arguments direct lsof to search for open files with a `/'
419 path name, not all open files in the `/' (root) file system.
420 Be careful to make sure +f and -f are properly terminated and
422 aren't followed by a character (e.g., of the file or file sys‐
423 tem name) that might be taken as a parameter. For example,
424 use ``--'' after +f and -f as in these examples.
425 $ lsof +f -- /file/system/name
427 $ lsof -f -- /file/name
428 The listing of information from kernel file structures, re‐
430 quested with the +f [cfgGn] option form, is normally inhib‐
431 ited, and is not available in whole or part for some dialects
432 - e.g., /proc-based Linux kernels below 2.6.22. When the pre‐
433 fix to f is a plus sign (`+'), these characters request file
434 structure information:
435 c file structure use count (not Linux)
437 f file structure address (not Linux)
438 g file flag abbreviations (Linux 2.6.22 and up)
439 Abbrev. Flag in C code (see open(2))
441 W O_WRONLY
443 RW O_RDWR
444 CR O_CREAT
445 EXCL O_EXCL
446 NTTY O_NOCTTY
447 TR O_TRUNC
448 AP O_APPEND
449 ND O_NDELAY
450 SYN O_SYNC
451 ASYN O_ASYNC
452 DIR O_DIRECT
453 DTY O_DIRECTORY
454 NFLK O_NOFOLLOW
455 NATM O_NOATIME
456 DSYN O_DSYNC
457 RSYN O_RSYNC
458 LG O_LARGEFILE
459 CX O_CLOEXEC
460 TMPF O_TMPFILE
461 G file flags in hexadecimal (Linux 2.6.22 and up)
463 n file structure node address (not Linux)
464 When the prefix is minus (`-') the same characters disable the
466 listing of the indicated values.
467 File structure addresses, use counts, flags, and node ad‐
469 dresses may be used to detect more readily identical files in‐
470 herited by child processes and identical files in use by dif‐
471 ferent processes. Lsof column output can be sorted by output
472 columns holding the values and listed to identify identical
473 file use, or lsof field output can be parsed by an AWK or Perl
474 post-filter script, or by a C program.
475 -F f specifies a character list, f, that selects the fields to be
477 output for processing by another program, and the character
478 that terminates each output field. Each field to be output is
479 specified with a single character in f. The field terminator
480 defaults to NL, but may be changed to NUL (000). See the OUT‐
481 PUT FOR OTHER PROGRAMS section for a description of the field
482 identification characters and the field output process.
483 When the field selection character list is empty, all standard
485 fields are selected (except the raw device field, security
486 context and zone field for compatibility reasons) and the NL
487 field terminator is used.
488 When the field selection character list contains only a zero
490 (`0'), all fields are selected (except the raw device field
491 for compatibility reasons) and the NUL terminator character is
492 used.
493 Other combinations of fields and their associated field termi‐
495 nator character must be set with explicit entries in f, as de‐
496 scribed in the OUTPUT FOR OTHER PROGRAMS section.
497 When a field selection character identifies an item lsof does
499 not normally list - e.g., PPID, selected with -R - specifica‐
500 tion of the field character - e.g., ``-FR'' - also selects the
501 listing of the item.
502 When the field selection character list contains the single
504 character `?', lsof will display a help list of the field
505 identification characters. (Escape the `?' character as your
506 shell requires.)
507 -g [s] excludes or selects the listing of files for the processes
509 whose optional process group IDentification (PGID) numbers are
510 in the comma-separated set s - e.g., ``123'' or ``123,^456''.
511 (There should be no spaces in the set.)
512 PGID numbers that begin with `^' (negation) represent exclu‐
514 sions.
515 Multiple PGID numbers are joined in a single ORed set before
517 participating in AND option selection. However, PGID exclu‐
518 sions are applied without ORing or ANDing and take effect be‐
519 fore other selection criteria are applied.
520 The -g option also enables the output display of PGID numbers.
522 When specified without a PGID set that's all it does.
523 -i [i] selects the listing of files any of whose Internet address
525 matches the address specified in i. If no address is speci‐
526 fied, this option selects the listing of all Internet and x.25
527 (HP-UX) network files.
528 If -i4 or -i6 is specified with no following address, only
530 files of the indicated IP version, IPv4 or IPv6, are dis‐
531 played. (An IPv6 specification may be used only if the di‐
532 alects supports IPv6, as indicated by ``[46]'' and ``IPv[46]''
533 in lsof's -h or -? output.) Sequentially specifying -i4,
534 followed by -i6 is the same as specifying -i, and vice-versa.
535 Specifying -i4, or -i6 after -i is the same as specifying -i4
536 or -i6 by itself.
537 Multiple addresses (up to a limit of 100) may be specified
539 with multiple -i options. (A port number or service name
540 range is counted as one address.) They are joined in a single
541 ORed set before participating in AND option selection.
542 An Internet address is specified in the form (Items in square
544 brackets are optional.):
545 [46][protocol][@hostname|hostaddr][:service|port]
547 where:
549 46 specifies the IP version, IPv4 or IPv6
550 that applies to the following address.
551 '6' may be be specified only if the UNIX
552 dialect supports IPv6. If neither '4' nor
553 '6' is specified, the following address
554 applies to all IP versions.
555 protocol is a protocol name - TCP, UDP or UDPLITE.
556 hostname is an Internet host name. Unless a
557 specific IP version is specified, open
558 network files associated with host names
559 of all versions will be selected.
560 hostaddr is a numeric Internet IPv4 address in
561 dot form; or an IPv6 numeric address in
562 colon form, enclosed in brackets, if the
563 UNIX dialect supports IPv6. When an IP
564 version is selected, only its numeric
565 addresses may be specified.
566 service is an /etc/services name - e.g., smtp -
567 or a list of them.
568 port is a port number, or a list of them.
569 IPv6 options may be used only if the UNIX dialect supports
571 IPv6. To see if the dialect supports IPv6, run lsof and spec‐
572 ify the -h or -? (help) option. If the displayed description
573 of the -i option contains ``[46]'' and ``IPv[46]'', IPv6 is
574 supported.
575 IPv4 host names and addresses may not be specified if network
577 file selection is limited to IPv6 with -i 6. IPv6 host names
578 and addresses may not be specified if network file selection
579 is limited to IPv4 with -i 4. When an open IPv4 network
580 file's address is mapped in an IPv6 address, the open file's
581 type will be IPv6, not IPv4, and its display will be selected
582 by '6', not '4'.
583 At least one address component - 4, 6, protocol, hostname,
585 hostaddr, or service - must be supplied. The `@' character,
586 leading the host specification, is always required; as is the
587 `:', leading the port specification. Specify either hostname
588 or hostaddr. Specify either service name list or port number
589 list. If a service name list is specified, the protocol may
590 also need to be specified if the TCP, UDP and UDPLITE port
591 numbers for the service name are different. Use any case -
592 lower or upper - for protocol.
593 Service names and port numbers may be combined in a list whose
595 entries are separated by commas and whose numeric range en‐
596 tries are separated by minus signs. There may be no embedded
597 spaces, and all service names must belong to the specified
598 protocol. Since service names may contain embedded minus
599 signs, the starting entry of a range can't be a service name;
600 it can be a port number, however.
601 Here are some sample addresses:
603 -i6 - IPv6 only
605 TCP:25 - TCP and port 25
606 @1.2.3.4 - Internet IPv4 host address 1.2.3.4
607 @[3ffe:1ebc::1]:1234 - Internet IPv6 host address
608 3ffe:1ebc::1, port 1234
609 UDP:who - UDP who service port
610 TCP@lsof.itap:513 - TCP, port 513 and host name lsof.itap
611 tcp@foo:1-10,smtp,99 - TCP, ports 1 through 10,
612 service name smtp, port 99, host name foo
613 tcp@bar:1-smtp - TCP, ports 1 through smtp, host bar
614 :time - either TCP, UDP or UDPLITE time service port
615 -K k selects the listing of tasks (threads) of processes, on di‐
617 alects where task (thread) reporting is supported. (If help
618 output - i.e., the output of the -h or -? options - shows
619 this option, then task (thread) reporting is supported by the
620 dialect.)
621 If -K is followed by a value, k, it must be ``i''. That
623 causes lsof to ignore tasks, particularly in the default,
624 list-everything case when no other options are specified.
625 When -K and -a are both specified on Linux, and the tasks of a
627 main process are selected by other options, the main process
628 will also be listed as though it were a task, but without a
629 task ID. (See the description of the TID column in the OUTPUT
630 section.)
631 Where the FreeBSD version supports threads, all threads will
633 be listed with their IDs.
634 In general threads and tasks inherit the files of the caller,
636 but may close some and open others, so lsof always reports all
637 the open files of threads and tasks.
638 -k k specifies a kernel name list file, k, in place of /vmunix,
640 /mach, etc. -k is not available under AIX on the IBM
641 RISC/System 6000.
642 -l inhibits the conversion of user ID numbers to login names. It
644 is also useful when login name lookup is working improperly or
645 slowly.
646 +|-L [l] enables (`+') or disables (`-') the listing of file link
648 counts, where they are available - e.g., they aren't available
649 for sockets, or most FIFOs and pipes.
650 When +L is specified without a following number, all link
652 counts will be listed. When -L is specified (the default), no
653 link counts will be listed.
654 When +L is followed by a number, only files having a link
656 count less than that number will be listed. (No number may
657 follow -L.) A specification of the form ``+L1'' will select
658 open files that have been unlinked. A specification of the
659 form ``+aL1 <file_system>'' will select unlinked open files on
660 the specified file system.
661 For other link count comparisons, use field output (-F) and a
663 post-processing script or program.
664 +|-m m specifies an alternate kernel memory file or activates mount
666 table supplement processing.
667 The option form -m m specifies a kernel memory file, m, in
669 place of /dev/kmem or /dev/mem - e.g., a crash dump file.
670 The option form +m requests that a mount supplement file be
672 written to the standard output file. All other options are
673 silently ignored.
674 There will be a line in the mount supplement file for each
676 mounted file system, containing the mounted file system direc‐
677 tory, followed by a single space, followed by the device num‐
678 ber in hexadecimal "0x" format - e.g.,
679 / 0x801
681 Lsof can use the mount supplement file to get device numbers
683 for file systems when it can't get them via stat(2) or
684 lstat(2).
685 The option form +m m identifies m as a mount supplement file.
687 Note: the +m and +m m options are not available for all sup‐
689 ported dialects. Check the output of lsof's -h or -? options
690 to see if the +m and +m m options are available.
691 +|-M Enables (+) or disables (-) the reporting of portmapper regis‐
693 trations for local TCP, UDP and UDPLITE ports, where port map‐
694 ping is supported. (See the last paragraph of this option de‐
695 scription for information about where portmapper registration
696 reporting is supported.)
697 The default reporting mode is set by the lsof builder with the
699 HASPMAPENABLED #define in the dialect's machine.h header file;
700 lsof is distributed with the HASPMAPENABLED #define deacti‐
701 vated, so portmapper reporting is disabled by default and must
702 be requested with +M. Specifying lsof's -h or -? option will
703 report the default mode. Disabling portmapper registration
704 when it is already disabled or enabling it when already en‐
705 abled is acceptable. When portmapper registration reporting
706 is enabled, lsof displays the portmapper registration (if any)
707 for local TCP, UDP or UDPLITE ports in square brackets immedi‐
708 ately following the port numbers or service names - e.g.,
709 ``:1234[name]'' or ``:name[100083]''. The registration infor‐
710 mation may be a name or number, depending on what the regis‐
711 tering program supplied to the portmapper when it registered
712 the port.
713 When portmapper registration reporting is enabled, lsof may
715 run a little more slowly or even become blocked when access to
716 the portmapper becomes congested or stopped. Reverse the re‐
717 porting mode to determine if portmapper registration reporting
718 is slowing or blocking lsof.
719 For purposes of portmapper registration reporting lsof consid‐
721 ers a TCP, UDP or UDPLITE port local if: it is found in the
722 local part of its containing kernel structure; or if it is lo‐
723 cated in the foreign part of its containing kernel structure
724 and the local and foreign Internet addresses are the same; or
725 if it is located in the foreign part of its containing kernel
726 structure and the foreign Internet address is INADDR_LOOPBACK
727 (127.0.0.1). This rule may make lsof ignore some foreign
728 ports on machines with multiple interfaces when the foreign
729 Internet address is on a different interface from the local
730 one.
731 See the lsof FAQ (The FAQ section gives its location.) for
733 further discussion of portmapper registration reporting is‐
734 sues.
735 Portmapper registration reporting is supported only on di‐
737 alects that have RPC header files. (Some Linux distributions
738 with GlibC 2.14 do not have them.) When portmapper registra‐
739 tion reporting is supported, the -h or -? help output will
740 show the +|-M option.
741 -n inhibits the conversion of network numbers to host names for
743 network files. Inhibiting conversion may make lsof run
744 faster. It is also useful when host name lookup is not work‐
745 ing properly.
746 -N selects the listing of NFS files.
748 -o directs lsof to display file offset at all times. It causes
750 the SIZE/OFF output column title to be changed to OFFSET.
751 Note: on some UNIX dialects lsof can't obtain accurate or con‐
752 sistent file offset information from its kernel data sources,
753 sometimes just for particular kinds of files (e.g., socket
754 files.) Consult the lsof FAQ (The FAQ section gives its loca‐
755 tion.) for more information.
756 The -o and -s options are mutually exclusive; they can't both
758 be specified. When neither is specified, lsof displays what‐
759 ever value - size or offset - is appropriate and available for
760 the type of the file.
761 -o o defines the number of decimal digits (o) to be printed after
763 the ``0t'' for a file offset before the form is switched to
764 ``0x...''. An o value of zero (unlimited) directs lsof to use
765 the ``0t'' form for all offset output.
766 This option does NOT direct lsof to display offset at all
768 times; specify -o (without a trailing number) to do that. -o
769 o only specifies the number of digits after ``0t'' in either
770 mixed size and offset or offset-only output. Thus, for exam‐
771 ple, to direct lsof to display offset at all times with a dec‐
772 imal digit count of 10, use:
773 -o -o 10
775 or
776 -oo10
777 The default number of digits allowed after ``0t'' is normally
779 8, but may have been changed by the lsof builder. Consult the
780 description of the -o o option in the output of the -h or -?
781 option to determine the default that is in effect.
782 -O directs lsof to bypass the strategy it uses to avoid being
784 blocked by some kernel operations - i.e., doing them in forked
785 child processes. See the BLOCKS AND TIMEOUTS and AVOIDING
786 KERNEL BLOCKS sections for more information on kernel opera‐
787 tions that may block lsof.
788 While use of this option will reduce lsof startup overhead, it
790 may also cause lsof to hang when the kernel doesn't respond to
791 a function. Use this option cautiously.
792 -p s excludes or selects the listing of files for the processes
794 whose optional process IDentification (PID) numbers are in the
795 comma-separated set s - e.g., ``123'' or ``123,^456''. (There
796 should be no spaces in the set.)
797 PID numbers that begin with `^' (negation) represent exclu‐
799 sions.
800 Multiple process ID numbers are joined in a single ORed set
802 before participating in AND option selection. However, PID
803 exclusions are applied without ORing or ANDing and take effect
804 before other selection criteria are applied.
805 -P inhibits the conversion of port numbers to port names for net‐
807 work files. Inhibiting the conversion may make lsof run a
808 little faster. It is also useful when port name lookup is not
809 working properly.
810 -Q ignore failed search terms. When lsof is told to search for
812 users of a file, or for users of a device, or for a specific
813 PID, or for certain protocols in use by that PID, and so on,
814 lsof will return an error if any of the search results are
815 empty. The -Q option will change this behavior so that lsof
816 will instead return a successful exit code (0) even if any of
817 the search results are empty. In addition, missing search
818 terms will not be reported to stderr.
819 +|-r [t[c<N>][m<fmt>]]
821 puts lsof in repeat mode. There lsof lists open files as se‐
822 lected by other options, delays t seconds (default fifteen),
823 then repeats the listing, delaying and listing repetitively
824 until stopped by a condition defined by the prefix to the op‐
825 tion.
826 If the prefix is a `-', repeat mode is endless. Lsof must be
828 terminated with an interrupt or quit signal. `c<N>' is for
829 specifying the limits of repeating; if the number of itera‐
830 tions reaches at `<N>', Lsof stops itself.
831 If the prefix is `+', repeat mode will end the first cycle no
833 open files are listed - and of course when lsof is stopped
834 with an interrupt or quit signal. When repeat mode ends be‐
835 cause no files are listed, the process exit code will be zero
836 if any open files were ever listed; one, if none were ever
837 listed.
838 Lsof marks the end of each listing: if field output is in
840 progress (the -F, option has been specified), the default
841 marker is `m'; otherwise the default marker is ``========''.
842 The marker is followed by a NL character.
843 The optional "m<fmt>" argument specifies a format for the
845 marker line. The <fmt> characters following `m' are inter‐
846 preted as a format specification to the strftime(3) function,
847 when both it and the localtime(3) function are available in
848 the dialect's C library. Consult the strftime(3) documenta‐
849 tion for what may appear in its format specification. Note
850 that when field output is requested with the -F option, <fmt>
851 cannot contain the NL format, ``%n''. Note also that when
852 <fmt> contains spaces or other characters that affect the
853 shell's interpretation of arguments, <fmt> must be quoted ap‐
854 propriately.
855 Repeat mode reduces lsof startup overhead, so it is more effi‐
857 cient to use this mode than to call lsof repetitively from a
858 shell script, for example.
859 To use repeat mode most efficiently, accompany +|-r with spec‐
861 ification of other lsof selection options, so the amount of
862 kernel memory access lsof does will be kept to a minimum. Op‐
863 tions that filter at the process level - e.g., -c, -g, -p, -u
864 - are the most efficient selectors.
865 Repeat mode is useful when coupled with field output (see the
867 -F, option description) and a supervising awk or Perl script,
868 or a C program.
869 -R directs lsof to list the Parent Process IDentification number
871 in the PPID column.
872 -s [p:s] s alone directs lsof to display file size at all times. It
874 causes the SIZE/OFF output column title to be changed to SIZE.
875 If the file does not have a size, nothing is displayed.
876 The optional -s p:s form is available only for selected di‐
878 alects, and only when the -h or -? help output lists it.
879 When the optional form is available, the s may be followed by
881 a protocol name (p), either TCP or UDP, a colon (`:') and a
882 comma-separated protocol state name list, the option causes
883 open TCP and UDP files to be excluded if their state name(s)
884 are in the list (s) preceded by a `^'; or included if their
885 name(s) are not preceded by a `^'.
886 Dialects that support this option may support only one proto‐
888 col. When an unsupported protocol is specified, a message
889 will be displayed indicating state names for the protocol are
890 unavailable.
891 When an inclusion list is defined, only network files with
893 state names in the list will be present in the lsof output.
894 Thus, specifying one state name means that only network files
895 with that lone state name will be listed.
896 Case is unimportant in the protocol or state names, but there
898 may be no spaces and the colon (`:') separating the protocol
899 name (p) and the state name list (s) is required.
900 If only TCP and UDP files are to be listed, as controlled by
902 the specified exclusions and inclusions, the -i option must be
903 specified, too. If only a single protocol's files are to be
904 listed, add its name as an argument to the -i option.
905 For example, to list only network files with TCP state LISTEN,
907 use:
908 -iTCP -sTCP:LISTEN
910 Or, for example, to list network files with all UDP states ex‐
912 cept Idle, use:
913 -iUDP -sUDP:^Idle
915 State names vary with UNIX dialects, so it's not possible to
917 provide a complete list. Some common TCP state names are:
918 CLOSED, IDLE, BOUND, LISTEN, ESTABLISHED, SYN_SENT, SYN_RCDV,
919 ESTABLISHED, CLOSE_WAIT, FIN_WAIT1, CLOSING, LAST_ACK,
920 FIN_WAIT_2, and TIME_WAIT. Two common UDP state names are Un‐
921 bound and Idle.
922 See the lsof FAQ (The FAQ section gives its location.) for
924 more information on how to use protocol state exclusion and
925 inclusion, including examples.
926 The -o (without a following decimal digit count) and -s option
928 (without a following protocol and state name list) are mutu‐
929 ally exclusive; they can't both be specified. When neither is
930 specified, lsof displays whatever value - size or offset - is
931 appropriate and available for the type of file.
932 Since some types of files don't have true sizes - sockets, FI‐
934 FOs, pipes, etc. - lsof displays for their sizes the content
935 amounts in their associated kernel buffers, if possible.
936 -S [t] specifies an optional time-out seconds value for kernel func‐
938 tions - lstat(2), readlink(2), and stat(2) - that might other‐
939 wise deadlock. The minimum for t is two; the default, fif‐
940 teen; when no value is specified, the default is used.
941 See the BLOCKS AND TIMEOUTS section for more information.
943 -T [t] controls the reporting of some TCP/TPI information, also re‐
945 ported by netstat(1), following the network addresses. In
946 normal output the information appears in parentheses, each
947 item except TCP or TPI state name identified by a keyword,
948 followed by `=', separated from others by a single space:
949 <TCP or TPI state name>
951 QR=<read queue length>
952 QS=<send queue length>
953 SO=<socket options and values>
954 SS=<socket states>
955 TF=<TCP flags and values>
956 WR=<window read length>
957 WW=<window write length>
958 Not all values are reported for all UNIX dialects. Items val‐
960 ues (when available) are reported after the item name and '='.
961 When the field output mode is in effect (See OUTPUT FOR OTHER
963 PROGRAMS.) each item appears as a field with a `T' leading
964 character.
965 -T with no following key characters disables TCP/TPI informa‐
967 tion reporting.
968 -T with following characters selects the reporting of specific
970 TCP/TPI information:
971 f selects reporting of socket options,
973 states and values, and TCP flags and
974 values.
975 q selects queue length reporting.
976 s selects connection state reporting.
977 w selects window size reporting.
978 Not all selections are enabled for some UNIX dialects. State
980 may be selected for all dialects and is reported by default.
981 The -h or -? help output for the -T option will show what se‐
982 lections may be used with the UNIX dialect.
983 When -T is used to select information - i.e., it is followed
985 by one or more selection characters - the displaying of state
986 is disabled by default, and it must be explicitly selected
987 again in the characters following -T. (In effect, then, the
988 default is equivalent to -Ts.) For example, if queue lengths
989 and state are desired, use -Tqs.
990 Socket options, socket states, some socket values, TCP flags
992 and one TCP value may be reported (when available in the UNIX
993 dialect) in the form of the names that commonly appear after
994 SO_, so_, SS_, TCP_ and TF_ in the dialect's header files -
995 most often <sys/socket.h>, <sys/socketvar.h> and
996 <netinet/tcp_var.h>. Consult those header files for the mean‐
997 ing of the flags, options, states and values.
998 ``SO='' precedes socket options and values; ``SS='', socket
1000 states; and ``TF='', TCP flags and values.
1001 If a flag or option has a value, the value will follow an '='
1003 and the name -- e.g., ``SO=LINGER=5'', ``SO=QLIM=5'',
1004 ``TF=MSS=512''. The following seven values may be reported:
1005 Name
1007 Reported Description (Common Symbol)
1008 KEEPALIVE keep alive time (SO_KEEPALIVE)
1010 LINGER linger time (SO_LINGER)
1011 MSS maximum segment size (TCP_MAXSEG)
1012 PQLEN partial listen queue connections
1013 QLEN established listen queue connections
1014 QLIM established listen queue limit
1015 RCVBUF receive buffer length (SO_RCVBUF)
1016 SNDBUF send buffer length (SO_SNDBUF)
1017 Details on what socket options and values, socket states, and
1019 TCP flags and values may be displayed for particular UNIX di‐
1020 alects may be found in the answer to the ``Why doesn't lsof
1021 report socket options, socket states, and TCP flags and values
1022 for my dialect?'' and ``Why doesn't lsof report the partial
1023 listen queue connection count for my dialect?'' questions in
1024 the lsof FAQ (The FAQ section gives its location.) On Linux
1025 this option also prints the state of UNIX domain sockets.
1026 -t produce terse output comprising only process identifiers
1028 (without a header), so that it is easy to use programmati‐
1029 cally. e.g.
1030 # reload anything using old SSL
1032 lsof -t /lib/*/libssl.so.* | xargs -r kill -HUP
1033 # get list of processes and then iterate over them (Bash only)
1035 mapfile -t pids < <(
1036 lsof -wt /var/log/your.log
1037 )
1038 for pid in "${pids[@]}" ; do
1039 your_command -p "$pid"
1040 done
1041 The -t option implies the -w option.
1043 -u s selects the listing of files for the user whose login names or
1045 user ID numbers are in the comma-separated set s - e.g.,
1046 ``abe'', or ``548,root''. (There should be no spaces in the
1047 set.)
1048 Multiple login names or user ID numbers are joined in a single
1050 ORed set before participating in AND option selection.
1051 If a login name or user ID is preceded by a `^', it becomes a
1053 negation - i.e., files of processes owned by the login name or
1054 user ID will never be listed. A negated login name or user ID
1055 selection is neither ANDed nor ORed with other selections; it
1056 is applied before all other selections and absolutely excludes
1057 the listing of the files of the process. For example, to di‐
1058 rect lsof to exclude the listing of files belonging to root
1059 processes, specify ``-u^root'' or ``-u^0''.
1060 -U selects the listing of UNIX domain socket files.
1062 -v selects the listing of lsof version information, including:
1064 revision number; when the lsof binary was constructed; who
1065 constructed the binary and where; the name of the compiler
1066 used to construct the lsof binary; the version number of the
1067 compiler when readily available; the compiler and loader flags
1068 used to construct the lsof binary; and system information,
1069 typically the output of uname's -a option.
1070 -V directs lsof to indicate the items it was asked to list and
1072 failed to find - command names, file names, Internet addresses
1073 or files, login names, NFS files, PIDs, PGIDs, and UIDs.
1074 When other options are ANDed to search options, or com‐
1076 pile-time options restrict the listing of some files, lsof may
1077 not report that it failed to find a search item when an ANDed
1078 option or compile-time option prevents the listing of the open
1079 file containing the located search item.
1080 For example, ``lsof -V -iTCP@foobar -a -d 999'' may not report
1082 a failure to locate open files at ``TCP@foobar'' and may not
1083 list any, if none have a file descriptor number of 999. A
1084 similar situation arises when HASSECURITY and HASNOSOCKSECU‐
1085 RITY are defined at compile time and they prevent the listing
1086 of open files.
1087 +|-w Enables (+) or disables (-) the suppression of warning mes‐
1089 sages.
1090 The lsof builder may choose to have warning messages disabled
1092 or enabled by default. The default warning message state is
1093 indicated in the output of the -h or -? option. Disabling
1094 warning messages when they are already disabled or enabling
1095 them when already enabled is acceptable.
1096 The -t option implies the -w option.
1098 -x [fl] may accompany the +d and +D options to direct their processing
1100 to cross over symbolic links and|or file system mount points
1101 encountered when scanning the directory (+d) or directory tree
1102 (+D).
1103 If -x is specified by itself without a following parameter,
1105 cross-over processing of both symbolic links and file system
1106 mount points is enabled. Note that when -x is specified with‐
1107 out a parameter, the next argument must begin with '-' or '+'.
1108 The optional 'f' parameter enables file system mount point
1110 cross-over processing; 'l', symbolic link cross-over process‐
1111 ing.
1112 The -x option may not be supplied without also supplying a +d
1114 or +D option.
1115 -X This is a dialect-specific option.
1117 AIX:
1119 This IBM AIX RISC/System 6000 option requests the reporting of
1120 executed text file and shared library references.
1121 WARNING: because this option uses the kernel readx() function,
1123 its use on a busy AIX system might cause an application
1124 process to hang so completely that it can neither be killed
1125 nor stopped. I have never seen this happen or had a report of
1126 its happening, but I think there is a remote possibility it
1127 could happen.
1128 By default use of readx() is disabled. On AIX 5L and above
1130 lsof may need setuid-root permission to perform the actions
1131 this option requests.
1132 The lsof builder may specify that the -X option be restricted
1134 to processes whose real UID is root. If that has been done,
1135 the -X option will not appear in the -h or -? help output un‐
1136 less the real UID of the lsof process is root. The default
1137 lsof distribution allows any UID to specify -X, so by default
1138 it will appear in the help output.
1139 When AIX readx() use is disabled, lsof may not be able to re‐
1141 port information for all text and loader file references, but
1142 it may also avoid exacerbating an AIX kernel directory search
1143 kernel error, known as the Stale Segment ID bug.
1144 The readx() function, used by lsof or any other program to ac‐
1146 cess some sections of kernel virtual memory, can trigger the
1147 Stale Segment ID bug. It can cause the kernel's dir_search()
1148 function to believe erroneously that part of an in-memory copy
1149 of a file system directory has been zeroed. Another applica‐
1150 tion process, distinct from lsof, asking the kernel to search
1151 the directory - e.g., by using open(2) - can cause
1152 dir_search() to loop forever, thus hanging the application
1153 process.
1154 Consult the lsof FAQ (The FAQ section gives its location.)
1156 and the 00README file of the lsof distribution for a more com‐
1157 plete description of the Stale Segment ID bug, its APAR, and
1158 methods for defining readx() use when compiling lsof.
1159 Linux:
1161 This Linux option requests that lsof skip the reporting of in‐
1162 formation on all open TCP, UDP and UDPLITE IPv4 and IPv6
1163 files.
1164 This Linux option is most useful when the system has an ex‐
1166 tremely large number of open TCP, UDP and UDPLITE files, the
1167 processing of whose information in the /proc/net/tcp* and
1168 /proc/net/udp* files would take lsof a long time, and whose
1169 reporting is not of interest.
1170 Use this option with care and only when you are sure that the
1172 information you want lsof to display isn't associated with
1173 open TCP, UDP or UDPLITE socket files.
1174 Solaris 10 and above:
1176 This Solaris 10 and above option requests the reporting of
1177 cached paths for files that have been deleted - i.e., removed
1178 with rm(1) or unlink(2).
1179 The cached path is followed by the string `` (deleted)'' to
1181 indicate that the path by which the file was opened has been
1182 deleted.
1183 Because intervening changes made to the path - i.e., renames
1185 with mv(1) or rename(2) - are not recorded in the cached path,
1186 what lsof reports is only the path by which the file was
1187 opened, not its possibly different final path.
1188 -z [z] specifies how Solaris 10 and higher zone information is to be
1190 handled.
1191 Without a following argument - e.g., NO z - the option speci‐
1193 fies that zone names are to be listed in the ZONE output col‐
1194 umn.
1195 The -z option may be followed by a zone name, z. That causes
1197 lsof to list only open files for processes in that zone. Mul‐
1198 tiple -z z option and argument pairs may be specified to form
1199 a list of named zones. Any open file of any process in any of
1200 the zones will be listed, subject to other conditions speci‐
1201 fied by other options and arguments.
1202 -Z [Z] specifies how SELinux security contexts are to be handled. It
1204 and 'Z' field output character support are inhibited when
1205 SELinux is disabled in the running Linux kernel. See OUTPUT
1206 FOR OTHER PROGRAMS for more information on the 'Z' field out‐
1207 put character.
1208 Without a following argument - e.g., NO Z - the option speci‐
1210 fies that security contexts are to be listed in the SECU‐
1211 RITY-CONTEXT output column.
1212 The -Z option may be followed by a wildcard security context
1214 name, Z. That causes lsof to list only open files for pro‐
1215 cesses in that security context. Multiple -Z Z option and ar‐
1216 gument pairs may be specified to form a list of security con‐
1217 texts. Any open file of any process in any of the security
1218 contexts will be listed, subject to other conditions specified
1219 by other options and arguments. Note that Z can be A:B:C or
1220 *:B:C or A:B:* or *:*:C to match against the A:B:C context.
1221 -- The double minus sign option is a marker that signals the end
1223 of the keyed options. It may be used, for example, when the
1224 first file name begins with a minus sign. It may also be used
1225 when the absence of a value for the last keyed option must be
1226 signified by the presence of a minus sign in the following op‐
1227 tion and before the start of the file names.
1228 names These are path names of specific files to list. Symbolic
1230 links are resolved before use. The first name may be sepa‐
1231 rated from the preceding options with the ``--'' option.
1232 If a name is the mounted-on directory of a file system or the
1234 device of the file system, lsof will list all the files open
1235 on the file system. To be considered a file system, the name
1236 must match a mounted-on directory name in mount(8) output, or
1237 match the name of a block device associated with a mounted-on
1238 directory name. The +|-f option may be used to force lsof to
1239 consider a name a file system identifier (+f) or a simple file
1240 (-f).
1241 If name is a path to a directory that is not the mounted-on
1243 directory name of a file system, it is treated just as a regu‐
1244 lar file is treated - i.e., its listing is restricted to pro‐
1245 cesses that have it open as a file or as a process-specific
1246 directory, such as the root or current working directory. To
1247 request that lsof look for open files inside a directory name,
1248 use the +d s and +D D options.
1249 If a name is the base name of a family of multiplexed files -
1251 e.g, AIX's /dev/pt[cs] - lsof will list all the associated
1252 multiplexed files on the device that are open - e.g.,
1253 /dev/pt[cs]/1, /dev/pt[cs]/2, etc.
1254 If a name is a UNIX domain socket name, lsof will usually
1256 search for it by the characters of the name alone - exactly as
1257 it is specified and is recorded in the kernel socket struc‐
1258 ture. (See the next paragraph for an exception to that rule
1259 for Linux.) Specifying a relative path - e.g., ./file - in
1260 place of the file's absolute path - e.g., /tmp/file - won't
1261 work because lsof must match the characters you specify with
1262 what it finds in the kernel UNIX domain socket structures.
1263 If a name is a Linux UNIX domain socket name, in one case lsof
1265 is able to search for it by its device and inode number, al‐
1266 lowing name to be a relative path. The case requires that the
1267 absolute path -- i.e., one beginning with a slash ('/') be
1268 used by the process that created the socket, and hence be
1269 stored in the /proc/net/unix file; and it requires that lsof
1270 be able to obtain the device and node numbers of both the ab‐
1271 solute path in /proc/net/unix and name via successful stat(2)
1272 system calls. When those conditions are met, lsof will be
1273 able to search for the UNIX domain socket when some path to it
1274 is is specified in name. Thus, for example, if the path is
1275 /dev/log, and an lsof search is initiated when the working di‐
1276 rectory is /dev, then name could be ./log.
1277 If a name is none of the above, lsof will list any open files
1279 whose device and inode match that of the specified path name.
1280 If you have also specified the -b option, the only names you
1282 may safely specify are file systems for which your mount table
1283 supplies alternate device numbers. See the AVOIDING KERNEL
1284 BLOCKS and ALTERNATE DEVICE NUMBERS sections for more informa‐
1285 tion.
1286 Multiple file names are joined in a single ORed set before
1288 participating in AND option selection.
1289
1291 Lsof supports the recognition of AFS files for these dialects (and AFS
1292 versions):
1293 AIX 4.1.4 (AFS 3.4a)
1295 HP-UX 9.0.5 (AFS 3.4a)
1296 Linux 1.2.13 (AFS 3.3)
1297 Solaris 2.[56] (AFS 3.4a)
1298 It may recognize AFS files on other versions of these dialects, but has
1300 not been tested there. Depending on how AFS is implemented, lsof may
1301 recognize AFS files in other dialects, or may have difficulties recog‐
1302 nizing AFS files in the supported dialects.
1303 Lsof may have trouble identifying all aspects of AFS files in supported
1305 dialects when AFS kernel support is implemented via dynamic modules
1306 whose addresses do not appear in the kernel's variable name list. In
1307 that case, lsof may have to guess at the identity of AFS files, and
1308 might not be able to obtain volume information from the kernel that is
1309 needed for calculating AFS volume node numbers. When lsof can't com‐
1310 pute volume node numbers, it reports blank in the NODE column.
1311 The -A A option is available in some dialect implementations of lsof
1313 for specifying the name list file where dynamic module kernel addresses
1314 may be found. When this option is available, it will be listed in the
1315 lsof help output, presented in response to the -h or -?
1316 See the lsof FAQ (The FAQ section gives its location.) for more infor‐
1318 mation about dynamic modules, their symbols, and how they affect lsof
1319 options.
1320 Because AFS path lookups don't seem to participate in the kernel's name
1322 cache operations, lsof can't identify path name components for AFS
1323 files.
1324
1326 Lsof has three features that may cause security concerns. First, its
1327 default compilation mode allows anyone to list all open files with it.
1328 Second, by default it creates a user-readable and user-writable device
1329 cache file in the home directory of the real user ID that executes
1330 lsof. (The list-all-open-files and device cache features may be dis‐
1331 abled when lsof is compiled.) Third, its -k and -m options name alter‐
1332 nate kernel name list or memory files.
1333 Restricting the listing of all open files is controlled by the com‐
1335 pile-time HASSECURITY and HASNOSOCKSECURITY options. When HASSECURITY
1336 is defined, lsof will allow only the root user to list all open files.
1337 The non-root user may list only open files of processes with the same
1338 user IDentification number as the real user ID number of the lsof
1339 process (the one that its user logged on with).
1340 However, if HASSECURITY and HASNOSOCKSECURITY are both defined, anyone
1342 may list open socket files, provided they are selected with the -i op‐
1343 tion.
1344 When HASSECURITY is not defined, anyone may list all open files.
1346 Help output, presented in response to the -h or -? option, gives the
1348 status of the HASSECURITY and HASNOSOCKSECURITY definitions.
1349 See the Security section of the 00README file of the lsof distribution
1351 for information on building lsof with the HASSECURITY and HASNOSOCKSE‐
1352 CURITY options enabled.
1353 Creation and use of a user-readable and user-writable device cache file
1355 is controlled by the compile-time HASDCACHE option. See the DEVICE
1356 CACHE FILE section and the sections that follow it for details on how
1357 its path is formed. For security considerations it is important to
1358 note that in the default lsof distribution, if the real user ID under
1359 which lsof is executed is root, the device cache file will be written
1360 in root's home directory - e.g., / or /root. When HASDCACHE is not de‐
1361 fined, lsof does not write or attempt to read a device cache file.
1362 When HASDCACHE is defined, the lsof help output, presented in response
1364 to the -h, -D?, or -? options, will provide device cache file handling
1365 information. When HASDCACHE is not defined, the -h or -? output will
1366 have no -D option description.
1367 Before you decide to disable the device cache file feature - enabling
1369 it improves the performance of lsof by reducing the startup overhead of
1370 examining all the nodes in /dev (or /devices) - read the discussion of
1371 it in the 00DCACHE file of the lsof distribution and the lsof FAQ (The
1372 FAQ section gives its location.)
1373 WHEN IN DOUBT, YOU CAN TEMPORARILY DISABLE THE USE OF THE DEVICE CACHE
1375 FILE WITH THE -Di OPTION.
1376 When lsof user declares alternate kernel name list or memory files with
1378 the -k and -m options, lsof checks the user's authority to read them
1379 with access(2). This is intended to prevent whatever special power
1380 lsof's modes might confer on it from letting it read files not normally
1381 accessible via the authority of the real user ID.
1382
1384 This section describes the information lsof lists for each open file.
1385 See the OUTPUT FOR OTHER PROGRAMS section for additional information on
1386 output that can be processed by another program.
1387 Lsof only outputs printable (declared so by isprint(3)) 8 bit charac‐
1389 ters. Non-printable characters are printed in one of three forms: the
1390 C ``\[bfrnt]'' form; the control character `^' form (e.g., ``^@''); or
1391 hexadecimal leading ``\x'' form (e.g., ``\xab''). Space is non-print‐
1392 able in the COMMAND column (``\x20'') and printable elsewhere.
1393 For some dialects - if HASSETLOCALE is defined in the dialect's ma‐
1395 chine.h header file - lsof will print the extended 8 bit characters of
1396 a language locale. The lsof process must be supplied a language locale
1397 environment variable (e.g., LANG) whose value represents a known lan‐
1398 guage locale in which the extended characters are considered printable
1399 by isprint(3). Otherwise lsof considers the extended characters non-
1400 printable and prints them according to its rules for non-printable
1401 characters, stated above. Consult your dialect's setlocale(3) man page
1402 for the names of other environment variables that may be used in place
1403 of LANG - e.g., LC_ALL, LC_CTYPE, etc.
1404 Lsof's language locale support for a dialect also covers wide charac‐
1406 ters - e.g., UTF-8 - when HASSETLOCALE and HASWIDECHAR are defined in
1407 the dialect's machine.h header file, and when a suitable language lo‐
1408 cale has been defined in the appropriate environment variable for the
1409 lsof process. Wide characters are printable under those conditions if
1410 iswprint(3) reports them to be. If HASSETLOCALE, HASWIDECHAR and a
1411 suitable language locale aren't defined, or if iswprint(3) reports wide
1412 characters that aren't printable, lsof considers the wide characters
1413 non-printable and prints each of their 8 bits according to its rules
1414 for non-printable characters, stated above.
1415 Consult the answers to the "Language locale support" questions in the
1417 lsof FAQ (The FAQ section gives its location.) for more information.
1418 Lsof dynamically sizes the output columns each time it runs, guarantee‐
1420 ing that each column is a minimum size. It also guarantees that each
1421 column is separated from its predecessor by at least one space.
1422 COMMAND contains the first nine characters of the name of the UNIX
1424 command associated with the process. If a non-zero w value
1425 is specified to the +c w option, the column contains the
1426 first w characters of the name of the UNIX command associ‐
1427 ated with the process up to the limit of characters supplied
1428 to lsof by the UNIX dialect. (See the description of the +c
1429 w command or the lsof FAQ for more information. The FAQ
1430 section gives its location.)
1431 If w is less than the length of the column title, ``COM‐
1433 MAND'', it will be raised to that length.
1434 If a zero w value is specified to the +c w option, the col‐
1436 umn contains all the characters of the name of the UNIX com‐
1437 mand associated with the process.
1438 All command name characters maintained by the kernel in its
1440 structures are displayed in field output when the command
1441 name descriptor (`c') is specified. See the OUTPUT FOR
1442 OTHER COMMANDS section for information on selecting field
1443 output and the associated command name descriptor.
1444 PID is the Process IDentification number of the process.
1446 TID is the task (thread) IDentification number, if task (thread)
1448 reporting is supported by the dialect and a task (thread) is
1449 being listed. (If help output - i.e., the output of the -h
1450 or -? options - shows this option, then task (thread) re‐
1451 porting is supported by the dialect.)
1452 A blank TID column in Linux indicates a process - i.e., a
1454 non-task.
1455 TASKCMD is the task command name. Generally this will be the same
1457 as the process named in the COMMAND column, but some task
1458 implementations (e.g., Linux) permit a task to change its
1459 command name.
1460 The TASKCMD column width is subject to the same size limita‐
1462 tion as the COMMAND column.
1463 ZONE is the Solaris 10 and higher zone name. This column must be
1465 selected with the -z option.
1466 SECURITY-CONTEXT
1468 is the SELinux security context. This column must be se‐
1469 lected with the -Z option. Note that the -Z option is in‐
1470 hibited when SELinux is disabled in the running Linux ker‐
1471 nel.
1472 PPID is the Parent Process IDentification number of the process.
1474 It is only displayed when the -R option has been specified.
1475 PGID is the process group IDentification number associated with
1477 the process. It is only displayed when the -g option has
1478 been specified.
1479 USER is the user ID number or login name of the user to whom the
1481 process belongs, usually the same as reported by ps(1).
1482 However, on Linux USER is the user ID number or login that
1483 owns the directory in /proc where lsof finds information
1484 about the process. Usually that is the same value reported
1485 by ps(1), but may differ when the process has changed its
1486 effective user ID. (See the -l option description for in‐
1487 formation on when a user ID number or login name is dis‐
1488 played.)
1489 FD is the File Descriptor number of the file or:
1491 cwd current working directory;
1493 Lnn library references (AIX);
1494 err FD information error (see NAME column);
1495 jld jail directory (FreeBSD);
1496 ltx shared library text (code and data);
1497 Mxx hex memory-mapped type number xx.
1498 m86 DOS Merge mapped file;
1499 mem memory-mapped file;
1500 mmap memory-mapped device;
1501 pd parent directory;
1502 rtd root directory;
1503 tr kernel trace file (OpenBSD);
1504 txt program text (code and data);
1505 v86 VP/ix mapped file;
1506 FD is followed by one of these characters, describing the
1508 mode under which the file is open:
1509 r for read access;
1511 w for write access;
1512 u for read and write access;
1513 space if mode unknown and no lock
1514 character follows;
1515 `-' if mode unknown and lock
1516 character follows.
1517 The mode character is followed by one of these lock charac‐
1519 ters, describing the type of lock applied to the file:
1520 N for a Solaris NFS lock of unknown type;
1522 r for read lock on part of the file;
1523 R for a read lock on the entire file;
1524 w for a write lock on part of the file;
1525 W for a write lock on the entire file;
1526 u for a read and write lock of any length;
1527 U for a lock of unknown type;
1528 x for an SCO OpenServer Xenix lock on part of the
1529 file;
1530 X for an SCO OpenServer Xenix lock on the entire file;
1531 space if there is no lock.
1532 See the LOCKS section for more information on the lock in‐
1534 formation character.
1535 The FD column contents constitutes a single field for pars‐
1537 ing in post-processing scripts.
1538 TYPE is the type of the node associated with the file - e.g.,
1540 GDIR, GREG, VDIR, VREG, etc.
1541 or ``IPv4'' for an IPv4 socket;
1543 or ``IPv6'' for an open IPv6 network file - even if its ad‐
1545 dress is IPv4, mapped in an IPv6 address;
1546 or ``ax25'' for a Linux AX.25 socket;
1548 or ``inet'' for an Internet domain socket;
1550 or ``lla'' for a HP-UX link level access file;
1552 or ``rte'' for an AF_ROUTE socket;
1554 or ``sock'' for a socket of unknown domain;
1556 or ``unix'' for a UNIX domain socket;
1558 or ``x.25'' for an HP-UX x.25 socket;
1560 or ``BLK'' for a block special file;
1562 or ``CHR'' for a character special file;
1564 or ``DEL'' for a Linux map file that has been deleted;
1566 or ``DIR'' for a directory;
1568 or ``DOOR'' for a VDOOR file;
1570 or ``FIFO'' for a FIFO special file;
1572 or ``KQUEUE'' for a BSD style kernel event queue file;
1574 or ``LINK'' for a symbolic link file;
1576 or ``MPB'' for a multiplexed block file;
1578 or ``MPC'' for a multiplexed character file;
1580 or ``NOFD'' for a Linux /proc/<PID>/fd directory that can't
1582 be opened -- the directory path appears in the NAME column,
1583 followed by an error message;
1584 or ``PAS'' for a /proc/as file;
1586 or ``PAXV'' for a /proc/auxv file;
1588 or ``PCRE'' for a /proc/cred file;
1590 or ``PCTL'' for a /proc control file;
1592 or ``PCUR'' for the current /proc process;
1594 or ``PCWD'' for a /proc current working directory;
1596 or ``PDIR'' for a /proc directory;
1598 or ``PETY'' for a /proc executable type (etype);
1600 or ``PFD'' for a /proc file descriptor;
1602 or ``PFDR'' for a /proc file descriptor directory;
1604 or ``PFIL'' for an executable /proc file;
1606 or ``PFPR'' for a /proc FP register set;
1608 or ``PGD'' for a /proc/pagedata file;
1610 or ``PGID'' for a /proc group notifier file;
1612 or ``PIPE'' for pipes;
1614 or ``PLC'' for a /proc/lwpctl file;
1616 or ``PLDR'' for a /proc/lpw directory;
1618 or ``PLDT'' for a /proc/ldt file;
1620 or ``PLPI'' for a /proc/lpsinfo file;
1622 or ``PLST'' for a /proc/lstatus file;
1624 or ``PLU'' for a /proc/lusage file;
1626 or ``PLWG'' for a /proc/gwindows file;
1628 or ``PLWI'' for a /proc/lwpsinfo file;
1630 or ``PLWS'' for a /proc/lwpstatus file;
1632 or ``PLWU'' for a /proc/lwpusage file;
1634 or ``PLWX'' for a /proc/xregs file;
1636 or ``PMAP'' for a /proc map file (map);
1638 or ``PMEM'' for a /proc memory image file;
1640 or ``PNTF'' for a /proc process notifier file;
1642 or ``POBJ'' for a /proc/object file;
1644 or ``PODR'' for a /proc/object directory;
1646 or ``POLP'' for an old format /proc light weight process
1648 file;
1649 or ``POPF'' for an old format /proc PID file;
1651 or ``POPG'' for an old format /proc page data file;
1653 or ``PORT'' for a SYSV named pipe;
1655 or ``PREG'' for a /proc register file;
1657 or ``PRMP'' for a /proc/rmap file;
1659 or ``PRTD'' for a /proc root directory;
1661 or ``PSGA'' for a /proc/sigact file;
1663 or ``PSIN'' for a /proc/psinfo file;
1665 or ``PSTA'' for a /proc status file;
1667 or ``PSXMQ'' for a POSIX message queue file;
1669 or ``PSXSEM'' for a POSIX semaphore file;
1671 or ``PSXSHM'' for a POSIX shared memory file;
1673 or ``PTS'' for a /dev/pts file;
1675 or ``PUSG'' for a /proc/usage file;
1677 or ``PW'' for a /proc/watch file;
1679 or ``PXMP'' for a /proc/xmap file;
1681 or ``REG'' for a regular file;
1683 or ``SMT'' for a shared memory transport file;
1685 or ``STSO'' for a stream socket;
1687 or ``UNNM'' for an unnamed type file;
1689 or ``XNAM'' for an OpenServer Xenix special file of unknown
1691 type;
1692 or ``XSEM'' for an OpenServer Xenix semaphore file;
1694 or ``XSD'' for an OpenServer Xenix shared data file;
1696 or the four type number octets if the corresponding name
1698 isn't known.
1699 FILE-ADDR contains the kernel file structure address when f has been
1701 specified to +f;
1702 FCT contains the file reference count from the kernel file
1704 structure when c has been specified to +f;
1705 FILE-FLAG when g or G has been specified to +f, this field contains
1707 the contents of the f_flag[s] member of the kernel file
1708 structure and the kernel's per-process open file flags (if
1709 available); `G' causes them to be displayed in hexadecimal;
1710 `g', as short-hand names; two lists may be displayed with
1711 entries separated by commas, the lists separated by a semi‐
1712 colon (`;'); the first list may contain short-hand names for
1713 f_flag[s] values from the following table:
1714 AIO asynchronous I/O (e.g., FAIO)
1716 AP append
1717 ASYN asynchronous I/O (e.g., FASYNC)
1718 BAS block, test, and set in use
1719 BKIU block if in use
1720 BL use block offsets
1721 BSK block seek
1722 CA copy avoid
1723 CIO concurrent I/O
1724 CLON clone
1725 CLRD CL read
1726 CR create
1727 DF defer
1728 DFI defer IND
1729 DFLU data flush
1730 DIR direct
1731 DLY delay
1732 DOCL do clone
1733 DSYN data-only integrity
1734 DTY must be a directory
1735 EVO event only
1736 EX open for exec
1737 EXCL exclusive open
1738 FSYN synchronous writes
1739 GCDF defer during unp_gc() (AIX)
1740 GCMK mark during unp_gc() (AIX)
1741 GTTY accessed via /dev/tty
1742 HUP HUP in progress
1743 KERN kernel
1744 KIOC kernel-issued ioctl
1745 LCK has lock
1746 LG large file
1747 MBLK stream message block
1748 MK mark
1749 MNT mount
1750 MSYN multiplex synchronization
1751 NATM don't update atime
1752 NB non-blocking I/O
1753 NBDR no BDRM check
1754 NBIO SYSV non-blocking I/O
1755 NBF n-buffering in effect
1756 NC no cache
1757 ND no delay
1758 NDSY no data synchronization
1759 NET network
1760 NFLK don't follow links
1761 NMFS NM file system
1762 NOTO disable background stop
1763 NSH no share
1764 NTTY no controlling TTY
1765 OLRM OLR mirror
1766 PAIO POSIX asynchronous I/O
1767 PATH path
1768 PP POSIX pipe
1769 R read
1770 RC file and record locking cache
1771 REV revoked
1772 RSH shared read
1773 RSYN read synchronization
1774 RW read and write access
1775 SL shared lock
1776 SNAP cooked snapshot
1777 SOCK socket
1778 SQSH Sequent shared set on open
1779 SQSV Sequent SVM set on open
1780 SQR Sequent set repair on open
1781 SQS1 Sequent full shared open
1782 SQS2 Sequent partial shared open
1783 STPI stop I/O
1784 SWR synchronous read
1785 SYN file integrity while writing
1786 TCPM avoid TCP collision
1787 TMPF temporary file
1788 TR truncate
1789 W write
1790 WKUP parallel I/O synchronization
1791 WTG parallel I/O synchronization
1792 VH vhangup pending
1793 VTXT virtual text
1794 XL exclusive lock
1795 this list of names was derived from F* #define's in dialect
1797 header files <fcntl.h>, <linux</fs.h>, <sys/fcntl.c>,
1798 <sys/fcntlcom.h>, and <sys/file.h>; see the lsof.h header
1799 file for a list showing the correspondence between the above
1800 short-hand names and the header file definitions;
1801 the second list (after the semicolon) may contain short-hand
1803 names for kernel per-process open file flags from this ta‐
1804 ble:
1805 ALLC allocated
1807 BR the file has been read
1808 BHUP activity stopped by SIGHUP
1809 BW the file has been written
1810 CLSG closing
1811 CX close-on-exec (see fcntl(F_SETFD))
1812 LCK lock was applied
1813 MP memory-mapped
1814 OPIP open pending - in progress
1815 RSVW reserved wait
1816 SHMT UF_FSHMAT set (AIX)
1817 USE in use (multi-threaded)
1818 NODE-ID (or INODE-ADDR for some dialects) contains a unique identi‐
1820 fier for the file node (usually the kernel vnode or inode
1821 address, but also occasionally a concatenation of device and
1822 node number) when n has been specified to +f;
1823 DEVICE contains the device numbers, separated by commas, for a
1825 character special, block special, regular, directory or NFS
1826 file;
1827 or ``memory'' for a memory file system node under Tru64
1829 UNIX;
1830 or the address of the private data area of a Solaris socket
1832 stream;
1833 or a kernel reference address that identifies the file (The
1835 kernel reference address may be used for FIFO's, for exam‐
1836 ple.);
1837 or the base address or device name of a Linux AX.25 socket
1839 device.
1840 Usually only the lower thirty two bits of Tru64 UNIX kernel
1842 addresses are displayed.
1843 SIZE, SIZE/OFF, or OFFSET
1845 is the size of the file or the file offset in bytes. A
1846 value is displayed in this column only if it is available.
1847 Lsof displays whatever value - size or offset - is appropri‐
1848 ate for the type of the file and the version of lsof.
1849 On some UNIX dialects lsof can't obtain accurate or consis‐
1851 tent file offset information from its kernel data sources,
1852 sometimes just for particular kinds of files (e.g., socket
1853 files.) In other cases, files don't have true sizes - e.g.,
1854 sockets, FIFOs, pipes - so lsof displays for their sizes the
1855 content amounts it finds in their kernel buffer descriptors
1856 (e.g., socket buffer size counts or TCP/IP window sizes.)
1857 Consult the lsof FAQ (The FAQ section gives its location.)
1858 for more information.
1859 The file size is displayed in decimal; the offset is nor‐
1861 mally displayed in decimal with a leading ``0t'' if it con‐
1862 tains 8 digits or less; in hexadecimal with a leading ``0x''
1863 if it is longer than 8 digits. (Consult the -o o option de‐
1864 scription for information on when 8 might default to some
1865 other value.)
1866 Thus the leading ``0t'' and ``0x'' identify an offset when
1868 the column may contain both a size and an offset (i.e., its
1869 title is SIZE/OFF).
1870 If the -o option is specified, lsof always displays the file
1872 offset (or nothing if no offset is available) and labels the
1873 column OFFSET. The offset always begins with ``0t'' or
1874 ``0x'' as described above.
1875 The lsof user can control the switch from ``0t'' to ``0x''
1877 with the -o o option. Consult its description for more in‐
1878 formation.
1879 If the -s option is specified, lsof always displays the file
1881 size (or nothing if no size is available) and labels the
1882 column SIZE. The -o and -s options are mutually exclusive;
1883 they can't both be specified.
1884 For files that don't have a fixed size - e.g., don't reside
1886 on a disk device - lsof will display appropriate information
1887 about the current size or position of the file if it is
1888 available in the kernel structures that define the file.
1889 NLINK contains the file link count when +L has been specified;
1891 NODE is the node number of a local file;
1893 or the inode number of an NFS file in the server host;
1895 or the Internet protocol type - e.g, ``TCP'';
1897 or ``STR'' for a stream;
1899 or ``CCITT'' for an HP-UX x.25 socket;
1901 or the IRQ or inode number of a Linux AX.25 socket device.
1903 NAME is the name of the mount point and file system on which the
1905 file resides;
1906 or the name of a file specified in the names option (after
1908 any symbolic links have been resolved);
1909 or the name of a character special or block special device;
1911 or the local and remote Internet addresses of a network
1913 file; the local host name or IP number is followed by a
1914 colon (':'), the port, ``->'', and the two-part remote ad‐
1915 dress; IP addresses may be reported as numbers or names, de‐
1916 pending on the +|-M, -n, and -P options; colon-separated
1917 IPv6 numbers are enclosed in square brackets; IPv4 IN‐
1918 ADDR_ANY and IPv6 IN6_IS_ADDR_UNSPECIFIED addresses, and
1919 zero port numbers are represented by an asterisk ('*'); a
1920 UDP destination address may be followed by the amount of
1921 time elapsed since the last packet was sent to the destina‐
1922 tion; TCP, UDP and UDPLITE remote addresses may be followed
1923 by TCP/TPI information in parentheses - state (e.g., ``(ES‐
1924 TABLISHED)'', ``(Unbound)''), queue sizes, and window sizes
1925 (not all dialects) - in a fashion similar to what netstat(1)
1926 reports; see the -T option description or the description of
1927 the TCP/TPI field in OUTPUT FOR OTHER PROGRAMS for more in‐
1928 formation on state, queue size, and window size;
1929 or the address or name of a UNIX domain socket, possibly in‐
1931 cluding a stream clone device name, a file system object's
1932 path name, local and foreign kernel addresses, socket pair
1933 information, and a bound vnode address;
1934 or the local and remote mount point names of an NFS file;
1936 or ``STR'', followed by the stream name;
1938 or a stream character device name, followed by ``->'' and
1940 the stream name or a list of stream module names, separated
1941 by ``->'';
1942 or ``STR:'' followed by the SCO OpenServer stream device and
1944 module names, separated by ``->'';
1945 or system directory name, `` -- '', and as many components
1947 of the path name as lsof can find in the kernel's name cache
1948 for selected dialects (See the KERNEL NAME CACHE section for
1949 more information.);
1950 or ``PIPE->'', followed by a Solaris kernel pipe destination
1952 address;
1953 or ``COMMON:'', followed by the vnode device information
1955 structure's device name, for a Solaris common vnode;
1956 or the address family, followed by a slash (`/'), followed
1958 by fourteen comma-separated bytes of a non-Internet raw
1959 socket address;
1960 or the HP-UX x.25 local address, followed by the virtual
1962 connection number (if any), followed by the remote address
1963 (if any);
1964 or ``(dead)'' for disassociated Tru64 UNIX files - typically
1966 terminal files that have been flagged with the TIOCNOTTY
1967 ioctl and closed by daemons;
1968 or ``rd=<offset>'' and ``wr=<offset>'' for the values of the
1970 read and write offsets of a FIFO;
1971 or ``clone n:/dev/event'' for SCO OpenServer file clones of
1973 the /dev/event device, where n is the minor device number of
1974 the file;
1975 or ``(socketpair: n)'' for a Solaris 2.6, 8, 9 or 10 UNIX
1977 domain socket, created by the socketpair(3N) network func‐
1978 tion;
1979 or ``no PCB'' for socket files that do not have a protocol
1981 block associated with them, optionally followed by ``,
1982 CANTSENDMORE'' if sending on the socket has been disabled,
1983 or ``, CANTRCVMORE'' if receiving on the socket has been
1984 disabled (e.g., by the shutdown(2) function);
1985 or the local and remote addresses of a Linux IPX socket file
1987 in the form <net>:[<node>:]<port>, followed in parentheses
1988 by the transmit and receive queue sizes, and the connection
1989 state;
1990 or ``dgram'' or ``stream'' for the type UnixWare 7.1.1 and
1992 above in-kernel UNIX domain sockets, followed by a colon
1993 (':') and the local path name when available, followed by
1994 ``->'' and the remote path name or kernel socket address in
1995 hexadecimal when available;
1996 or the association value, association index, endpoint value,
1998 local address, local port, remote address and remote port
1999 for Linux SCTP sockets;
2000 or ``protocol: '' followed by the Linux socket's protocol
2002 attribute.
2003 For dialects that support a ``namefs'' file system, allowing one file
2005 to be attached to another with fattach(3C), lsof will add ``(FA:<ad‐
2006 dress1><direction><address2>)'' to the NAME column. <address1> and
2007 <address2> are hexadecimal vnode addresses. <direction> will be ``<-''
2008 if <address2> has been fattach'ed to this vnode whose address is <ad‐
2009 dress1>; and ``->'' if <address1>, the vnode address of this vnode, has
2010 been fattach'ed to <address2>. <address1> may be omitted if it already
2011 appears in the DEVICE column.
2012 Lsof may add two parenthetical notes to the NAME column for open So‐
2014 laris 10 files: ``(?)'' if lsof considers the path name of questionable
2015 accuracy; and ``(deleted)'' if the -X option has been specified and
2016 lsof detects the open file's path name has been deleted. Consult the
2017 lsof FAQ (The FAQ section gives its location.) for more information on
2018 these NAME column additions.
2019
2021 Lsof can't adequately report the wide variety of UNIX dialect file
2022 locks in a single character. What it reports in a single character is
2023 a compromise between the information it finds in the kernel and the
2024 limitations of the reporting format.
2025 Moreover, when a process holds several byte level locks on a file, lsof
2027 only reports the status of the first lock it encounters. If it is a
2028 byte level lock, then the lock character will be reported in lower case
2029 - i.e., `r', `w', or `x' - rather than the upper case equivalent re‐
2030 ported for a full file lock.
2031 Generally lsof can only report on locks held by local processes on lo‐
2033 cal files. When a local process sets a lock on a remotely mounted
2034 (e.g., NFS) file, the remote server host usually records the lock
2035 state. One exception is Solaris - at some patch levels of 2.3, and in
2036 all versions above 2.4, the Solaris kernel records information on re‐
2037 mote locks in local structures.
2038 Lsof has trouble reporting locks for some UNIX dialects. Consult the
2040 BUGS section of this manual page or the lsof FAQ (The FAQ section gives
2041 its location.) for more information.
2042
2044 When the -F option is specified, lsof produces output that is suitable
2045 for processing by another program - e.g, an awk or Perl script, or a C
2046 program.
2047 Each unit of information is output in a field that is identified with a
2049 leading character and terminated by a NL (012) (or a NUL (000) if the 0
2050 (zero) field identifier character is specified.) The data of the field
2051 follows immediately after the field identification character and ex‐
2052 tends to the field terminator.
2053 It is possible to think of field output as process and file sets. A
2055 process set begins with a field whose identifier is `p' (for process
2056 IDentifier (PID)). It extends to the beginning of the next PID field
2057 or the beginning of the first file set of the process, whichever comes
2058 first. Included in the process set are fields that identify the com‐
2059 mand, the process group IDentification (PGID) number, the task (thread)
2060 ID (TID), and the user ID (UID) number or login name.
2061 A file set begins with a field whose identifier is `f' (for file de‐
2063 scriptor). It is followed by lines that describe the file's access
2064 mode, lock state, type, device, size, offset, inode, protocol, name and
2065 stream module names. It extends to the beginning of the next file or
2066 process set, whichever comes first.
2067 When the NUL (000) field terminator has been selected with the 0 (zero)
2069 field identifier character, lsof ends each process and file set with a
2070 NL (012) character.
2071 Lsof always produces one field, the PID (`p') field. In repeat mode,
2073 the marker (`m') is also produced. All other fields may be declared
2074 optionally in the field identifier character list that follows the -F
2075 option. When a field selection character identifies an item lsof does
2076 not normally list - e.g., PPID, selected with -R - specification of the
2077 field character - e.g., ``-FR'' - also selects the listing of the item.
2078 Lsof version from 4.88 to 4.93.2 always produced one more field, the
2080 file descriptor (`f') field. However, lsof in this version doesn't pro‐
2081 duce it. This change is for supporting the use case that a user needs
2082 only the PID field, and doesn't need the file descriptor field. Specify
2083 `f' explicitly if you need the field.
2084 It is entirely possible to select a set of fields that cannot easily be
2086 parsed - e.g., if the field descriptor field is not selected, it may be
2087 difficult to identify file sets. To help you avoid this difficulty,
2088 lsof supports the -F option; it selects the output of all fields with
2089 NL terminators (the -F0 option pair selects the output of all fields
2090 with NUL terminators). For compatibility reasons neither -F nor -F0
2091 select the raw device field.
2092 These are the fields that lsof will produce. The single character
2094 listed first is the field identifier.
2095 a file access mode
2097 c process command name (all characters from proc or
2098 user structure)
2099 C file structure share count
2100 d file's device character code
2101 D file's major/minor device number (0x<hexadecimal>)
2102 f file descriptor
2103 F file structure address (0x<hexadecimal>)
2104 G file flaGs (0x<hexadecimal>; names if +fg follows)
2105 g process group ID
2106 i file's inode number
2107 K tasK ID
2108 k link count
2109 l file's lock status
2110 L process login name
2111 m marker between repeated output (always selected in repeat mode)
2112 M the task comMand name
2113 n file name, comment, Internet address
2114 N node identifier (ox<hexadecimal>
2115 o file's offset (0t<decimal> or 0x<hexadecimal>, see -o o)
2116 p process ID (always selected)
2117 P protocol name
2118 r raw device number (0x<hexadecimal>)
2119 R parent process ID
2120 s file's size (decimal)
2121 S file's stream identification
2122 t file's type
2123 T TCP/TPI information, identified by prefixes (the
2124 `=' is part of the prefix):
2125 QR=<read queue size>
2126 QS=<send queue size>
2127 SO=<socket options and values> (not all dialects)
2128 SS=<socket states> (not all dialects)
2129 ST=<connection state>
2130 TF=<TCP flags and values> (not all dialects)
2131 WR=<window read size> (not all dialects)
2132 WW=<window write size> (not all dialects)
2133 (TCP/TPI information isn't reported for all supported
2134 UNIX dialects. The -h or -? help output for the
2135 -T option will show what TCP/TPI reporting can be
2136 requested.)
2137 u process user ID
2138 z Solaris 10 and higher zone name
2139 Z SELinux security context (inhibited when SELinux is disabled)
2140 0 use NUL field terminator character in place of NL
2141 1-9 dialect-specific field identifiers (The output
2142 of -F? identifies the information to be found
2143 in dialect-specific fields.)
2144 You can get on-line help information on these characters and their de‐
2146 scriptions by specifying the -F? option pair. (Escape the `?' charac‐
2147 ter as your shell requires.) Additional information on field content
2148 can be found in the OUTPUT section.
2149 As an example, ``-F pcfn'' will select the process ID (`p'), command
2151 name (`c'), file descriptor (`f') and file name (`n') fields with an NL
2152 field terminator character; ``-F pcfn0'' selects the same output with a
2153 NUL (000) field terminator character.
2154 Lsof doesn't produce all fields for every process or file set, only
2156 those that are available. Some fields are mutually exclusive: file de‐
2157 vice characters and file major/minor device numbers; file inode number
2158 and protocol name; file name and stream identification; file size and
2159 offset. One or the other member of these mutually exclusive sets will
2160 appear in field output, but not both.
2161 Normally lsof ends each field with a NL (012) character. The 0 (zero)
2163 field identifier character may be specified to change the field termi‐
2164 nator character to a NUL (000). A NUL terminator may be easier to
2165 process with xargs [4m(1), for example, or with programs whose quoting
2166 mechanisms may not easily cope with the range of characters in the
2167 field output. When the NUL field terminator is in use, lsof ends each
2168 process and file set with a NL (012).
2169 Three aids to producing programs that can process lsof field output are
2171 included in the lsof distribution. The first is a C header file,
2172 lsof_fields.h, that contains symbols for the field identification char‐
2173 acters, indexes for storing them in a table, and explanation strings
2174 that may be compiled into programs. Lsof uses this header file.
2175 The second aid is a set of sample scripts that process field output,
2177 written in awk, Perl 4, and Perl 5. They're located in the scripts
2178 subdirectory of the lsof distribution.
2179 The third aid is the C library used for the lsof test suite. The test
2181 suite is written in C and uses field output to validate the correct op‐
2182 eration of lsof. The library can be found in the tests/LTlib.c file of
2183 the lsof distribution. The library uses the first aid, the
2184 lsof_fields.h header file.
2185
2187 Lsof can be blocked by some kernel functions that it uses - lstat(2),
2188 readlink(2), and stat(2). These functions are stalled in the kernel,
2189 for example, when the hosts where mounted NFS file systems reside be‐
2190 come inaccessible.
2191 Lsof attempts to break these blocks with timers and child processes,
2193 but the techniques are not wholly reliable. When lsof does manage to
2194 break a block, it will report the break with an error message. The
2195 messages may be suppressed with the -t and -w options.
2196 The default timeout value may be displayed with the -h or -? option,
2198 and it may be changed with the -S [t] option. The minimum for t is two
2199 seconds, but you should avoid small values, since slow system respon‐
2200 siveness can cause short timeouts to expire unexpectedly and perhaps
2201 stop lsof before it can produce any output.
2202 When lsof has to break a block during its access of mounted file system
2204 information, it normally continues, although with less information
2205 available to display about open files.
2206 Lsof can also be directed to avoid the protection of timers and child
2208 processes when using the kernel functions that might block by specify‐
2209 ing the -O option. While this will allow lsof to start up with less
2210 overhead, it exposes lsof completely to the kernel situations that
2211 might block it. Use this option cautiously.
2212
2214 You can use the -b option to tell lsof to avoid using kernel functions
2215 that would block. Some cautions apply.
2216 First, using this option usually requires that your system supply al‐
2218 ternate device numbers in place of the device numbers that lsof would
2219 normally obtain with the lstat(2) and stat(2) kernel functions. See
2220 the ALTERNATE DEVICE NUMBERS section for more information on alternate
2221 device numbers.
2222 Second, you can't specify names for lsof to locate unless they're file
2224 system names. This is because lsof needs to know the device and inode
2225 numbers of files listed with names in the lsof options, and the -b op‐
2226 tion prevents lsof from obtaining them. Moreover, since lsof only has
2227 device numbers for the file systems that have alternates, its ability
2228 to locate files on file systems depends completely on the availability
2229 and accuracy of the alternates. If no alternates are available, or if
2230 they're incorrect, lsof won't be able to locate files on the named file
2231 systems.
2232 Third, if the names of your file system directories that lsof obtains
2234 from your system's mount table are symbolic links, lsof won't be able
2235 to resolve the links. This is because the -b option causes lsof to
2236 avoid the kernel readlink(2) function it uses to resolve symbolic
2237 links.
2238 Finally, using the -b option causes lsof to issue warning messages when
2240 it needs to use the kernel functions that the -b option directs it to
2241 avoid. You can suppress these messages by specifying the -w option,
2242 but if you do, you won't see the alternate device numbers reported in
2243 the warning messages.
2244
2246 On some dialects, when lsof has to break a block because it can't get
2247 information about a mounted file system via the lstat(2) and stat(2)
2248 kernel functions, or because you specified the -b option, lsof can ob‐
2249 tain some of the information it needs - the device number and possibly
2250 the file system type - from the system mount table. When that is pos‐
2251 sible, lsof will report the device number it obtained. (You can sup‐
2252 press the report by specifying the -w option.)
2253 You can assist this process if your mount table is supported with an
2255 /etc/mtab or /etc/mnttab file that contains an options field by adding
2256 a ``dev=xxxx'' field for mount points that do not have one in their op‐
2257 tions strings. Note: you must be able to edit the file - i.e., some
2258 mount tables like recent Solaris /etc/mnttab or Linux /proc/mounts are
2259 read-only and can't be modified.
2260 You may also be able to supply device numbers using the +m and +m m op‐
2262 tions, provided they are supported by your dialect. Check the output
2263 of lsof's -h or -? options to see if the +m and +m m options are
2264 available.
2265 The ``xxxx'' portion of the field is the hexadecimal value of the file
2267 system's device number. (Consult the st_dev field of the output of the
2268 lstat(2) and stat(2) functions for the appropriate values for your file
2269 systems.) Here's an example from a Sun Solaris 2.6 /etc/mnttab for a
2270 file system remotely mounted via NFS:
2271 nfs ignore,noquota,dev=2a40001
2273 There's an advantage to having ``dev=xxxx'' entries in your mount table
2275 file, especially for file systems that are mounted from remote NFS
2276 servers. When a remote server crashes and you want to identify its
2277 users by running lsof on one of its clients, lsof probably won't be
2278 able to get output from the lstat(2) and stat(2) functions for the file
2279 system. If it can obtain the file system's device number from the
2280 mount table, it will be able to display the files open on the crashed
2281 NFS server.
2282 Some dialects that do not use an ASCII /etc/mtab or /etc/mnttab file
2284 for the mount table may still provide an alternative device number in
2285 their internal mount tables. This includes AIX, Apple Darwin, FreeBSD,
2286 NetBSD, OpenBSD, and Tru64 UNIX. Lsof knows how to obtain the alterna‐
2287 tive device number for these dialects and uses it when its attempt to
2288 lstat(2) or stat(2) the file system is blocked.
2289 If you're not sure your dialect supplies alternate device numbers for
2291 file systems from its mount table, use this lsof incantation to see if
2292 it reports any alternate device numbers:
2293 lsof -b
2295 Look for standard error file warning messages that begin ``assuming
2297 "dev=xxxx" from ...''.
2298
2300 Lsof is able to examine the kernel's name cache or use other kernel fa‐
2301 cilities (e.g., the ADVFS 4.x tag_to_path() function under Tru64 UNIX)
2302 on some dialects for most file system types, excluding AFS, and extract
2303 recently used path name components from it. (AFS file system path
2304 lookups don't use the kernel's name cache; some Solaris VxFS file sys‐
2305 tem operations apparently don't use it, either.)
2306 Lsof reports the complete paths it finds in the NAME column. If lsof
2308 can't report all components in a path, it reports in the NAME column
2309 the file system name, followed by a space, two `-' characters, another
2310 space, and the name components it has located, separated by the `/'
2311 character.
2312 When lsof is run in repeat mode - i.e., with the -r option specified -
2314 the extent to which it can report path name components for the same
2315 file may vary from cycle to cycle. That's because other running pro‐
2316 cesses can cause the kernel to remove entries from its name cache and
2317 replace them with others.
2318 Lsof's use of the kernel name cache to identify the paths of files can
2320 lead it to report incorrect components under some circumstances. This
2321 can happen when the kernel name cache uses device and node number as a
2322 key (e.g., SCO OpenServer) and a key on a rapidly changing file system
2323 is reused. If the UNIX dialect's kernel doesn't purge the name cache
2324 entry for a file when it is unlinked, lsof may find a reference to the
2325 wrong entry in the cache. The lsof FAQ (The FAQ section gives its lo‐
2326 cation.) has more information on this situation.
2327 Lsof can report path name components for these dialects:
2329 FreeBSD
2331 HP-UX
2332 Linux
2333 NetBSD
2334 NEXTSTEP
2335 OpenBSD
2336 OPENSTEP
2337 SCO OpenServer
2338 SCO|Caldera UnixWare
2339 Solaris
2340 Tru64 UNIX
2341 Lsof can't report path name components for these dialects:
2343 AIX
2345 If you want to know why lsof can't report path name components for some
2347 dialects, see the lsof FAQ (The FAQ section gives its location.)
2348
2350 Examining all members of the /dev (or /devices) node tree with stat(2)
2351 functions can be time consuming. What's more, the information that
2352 lsof needs - device number, inode number, and path - rarely changes.
2353 Consequently, lsof normally maintains an ASCII text file of cached /dev
2355 (or /devices) information (exception: the /proc-based Linux lsof where
2356 it's not needed.) The local system administrator who builds lsof can
2357 control the way the device cache file path is formed, selecting from
2358 these options:
2359 Path from the -D option;
2361 Path from an environment variable;
2362 System-wide path;
2363 Personal path (the default);
2364 Personal path, modified by an environment variable.
2365 Consult the output of the -h, -D? , or -? help options for the current
2367 state of device cache support. The help output lists the default
2368 read-mode device cache file path that is in effect for the current in‐
2369 vocation of lsof. The -D? option output lists the read-only and write
2370 device cache file paths, the names of any applicable environment vari‐
2371 ables, and the personal device cache path format.
2372 Lsof can detect that the current device cache file has been acciden‐
2374 tally or maliciously modified by integrity checks, including the compu‐
2375 tation and verification of a sixteen bit Cyclic Redundancy Check (CRC)
2376 sum on the file's contents. When lsof senses something wrong with the
2377 file, it issues a warning and attempts to remove the current cache file
2378 and create a new copy, but only to a path that the process can legiti‐
2379 mately write.
2380 The path from which a lsof process may attempt to read a device cache
2382 file may not be the same as the path to which it can legitimately
2383 write. Thus when lsof senses that it needs to update the device cache
2384 file, it may choose a different path for writing it from the path from
2385 which it read an incorrect or outdated version.
2386 If available, the -Dr option will inhibit the writing of a new device
2388 cache file. (It's always available when specified without a path name
2389 argument.)
2390 When a new device is added to the system, the device cache file may
2392 need to be recreated. Since lsof compares the mtime of the device
2393 cache file with the mtime and ctime of the /dev (or /devices) direc‐
2394 tory, it usually detects that a new device has been added; in that case
2395 lsof issues a warning message and attempts to rebuild the device cache
2396 file.
2397 Whenever lsof writes a device cache file, it sets its ownership to the
2399 real UID of the executing process, and its permission modes to 0600,
2400 this restricting its reading and writing to the file's owner.
2401
2403 Two permissions of the lsof executable affect its ability to access de‐
2404 vice cache files. The permissions are set by the local system adminis‐
2405 trator when lsof is installed.
2406 The first and rarer permission is setuid-root. It comes into effect
2408 when lsof is executed; its effective UID is then root, while its real
2409 (i.e., that of the logged-on user) UID is not. The lsof distribution
2410 recommends that versions for these dialects run setuid-root.
2411 HP-UX 11.11 and 11.23
2413 Linux
2414 The second and more common permission is setgid. It comes into effect
2416 when the effective group IDentification number (GID) of the lsof
2417 process is set to one that can access kernel memory devices - e.g.,
2418 ``kmem'', ``sys'', or ``system''.
2419 An lsof process that has setgid permission usually surrenders the per‐
2421 mission after it has accessed the kernel memory devices. When it does
2422 that, lsof can allow more liberal device cache path formations. The
2423 lsof distribution recommends that versions for these dialects run set‐
2424 gid and be allowed to surrender setgid permission.
2425 AIX 5.[12] and 5.3-ML1
2427 Apple Darwin 7.x Power Macintosh systems
2428 FreeBSD 4.x, 4.1x, 5.x and [6789].x for x86-based systems
2429 FreeBSD 5.x, [6789].x and 1[012].8for Alpha, AMD64 and Sparc64
2430 based systems
2431 HP-UX 11.00
2432 NetBSD 1.[456], 2.x and 3.x for Alpha, x86, and SPARC-based
2433 systems
2434 NEXTSTEP 3.[13] for NEXTSTEP architectures
2435 OpenBSD 2.[89] and 3.[0-9] for x86-based systems
2436 OPENSTEP 4.x
2437 SCO OpenServer Release 5.0.6 for x86-based systems
2438 SCO|Caldera UnixWare 7.1.4 for x86-based systems
2439 Solaris 2.6, 8, 9 and 10
2440 Tru64 UNIX 5.1
2441 (Note: lsof for AIX 5L and above needs setuid-root permission if its -X
2443 option is used.)
2444 Lsof for these dialects does not support a device cache, so the permis‐
2446 sions given to the executable don't apply to the device cache file.
2447 Linux
2449
2451 The -D option provides limited means for specifying the device cache
2452 file path. Its ? function will report the read-only and write device
2453 cache file paths that lsof will use.
2454 When the -D b, r, and u functions are available, you can use them to
2456 request that the cache file be built in a specific location (b[path]);
2457 read but not rebuilt (r[path]); or read and rebuilt (u[path]). The b,
2458 r, and u functions are restricted under some conditions. They are re‐
2459 stricted when the lsof process is setuid-root. The path specified with
2460 the r function is always read-only, even when it is available.
2461 The b, r, and u functions are also restricted when the lsof process
2463 runs setgid and lsof doesn't surrender the setgid permission. (See the
2464 LSOF PERMISSIONS THAT AFFECT DEVICE CACHE FILE ACCESS section for a
2465 list of implementations that normally don't surrender their setgid per‐
2466 mission.)
2467 A further -D function, i (for ignore), is always available.
2469 When available, the b function tells lsof to read device information
2471 from the kernel with the stat(2) function and build a device cache file
2472 at the indicated path.
2473 When available, the r function tells lsof to read the device cache
2475 file, but not update it. When a path argument accompanies -Dr, it
2476 names the device cache file path. The r function is always available
2477 when it is specified without a path name argument. If lsof is not run‐
2478 ning setuid-root and surrenders its setgid permission, a path name ar‐
2479 gument may accompany the r function.
2480 When available, the u function tells lsof to attempt to read and use
2482 the device cache file. If it can't read the file, or if it finds the
2483 contents of the file incorrect or outdated, it will read information
2484 from the kernel, and attempt to write an updated version of the device
2485 cache file, but only to a path it considers legitimate for the lsof
2486 process effective and real UIDs.
2487
2489 Lsof's second choice for the device cache file is the contents of the
2490 LSOFDEVCACHE environment variable. It avoids this choice if the lsof
2491 process is setuid-root, or the real UID of the process is root.
2492 A further restriction applies to a device cache file path taken from
2494 the LSOFDEVCACHE environment variable: lsof will not write a device
2495 cache file to the path if the lsof process doesn't surrender its setgid
2496 permission. (See the LSOF PERMISSIONS THAT AFFECT DEVICE CACHE FILE
2497 ACCESS section for information on implementations that don't surrender
2498 their setgid permission.)
2499 The local system administrator can disable the use of the LSOFDEVCACHE
2501 environment variable or change its name when building lsof. Consult
2502 the output of -D? for the environment variable's name.
2503
2505 The local system administrator may choose to have a system-wide device
2506 cache file when building lsof. That file will generally be constructed
2507 by a special system administration procedure when the system is booted
2508 or when the contents of /dev or /devices) changes. If defined, it is
2509 lsof's third device cache file path choice.
2510 You can tell that a system-wide device cache file is in effect for your
2512 local installation by examining the lsof help option output - i.e., the
2513 output from the -h or -? option.
2514 Lsof will never write to the system-wide device cache file path by de‐
2516 fault. It must be explicitly named with a -D function in a root-owned
2517 procedure. Once the file has been written, the procedure must change
2518 its permission modes to 0644 (owner-read and owner-write, group-read,
2519 and other-read).
2520
2522 The default device cache file path of the lsof distribution is one
2523 recorded in the home directory of the real UID that executes lsof.
2524 Added to the home directory is a second path component of the form
2525 .lsof_hostname.
2526 This is lsof's fourth device cache file path choice, and is usually the
2528 default. If a system-wide device cache file path was defined when lsof
2529 was built, this fourth choice will be applied when lsof can't find the
2530 system-wide device cache file. This is the only time lsof uses two
2531 paths when reading the device cache file.
2532 The hostname part of the second component is the base name of the exe‐
2534 cuting host, as returned by gethostname(2). The base name is defined
2535 to be the characters preceding the first `.' in the gethostname(2)
2536 output, or all the gethostname(2) output if it contains no `.'.
2537 The device cache file belongs to the user ID and is readable and
2539 writable by the user ID alone - i.e., its modes are 0600. Each dis‐
2540 tinct real user ID on a given host that executes lsof has a distinct
2541 device cache file. The hostname part of the path distinguishes device
2542 cache files in an NFS-mounted home directory into which device cache
2543 files are written from several different hosts.
2544 The personal device cache file path formed by this method represents a
2546 device cache file that lsof will attempt to read, and will attempt to
2547 write should it not exist or should its contents be incorrect or out‐
2548 dated.
2549 The -Dr option without a path name argument will inhibit the writing of
2551 a new device cache file.
2552 The -D? option will list the format specification for constructing the
2554 personal device cache file. The conversions used in the format speci‐
2555 fication are described in the 00DCACHE file of the lsof distribution.
2556
2558 If this option is defined by the local system administrator when lsof
2559 is built, the LSOFPERSDCPATH environment variable contents may be used
2560 to add a component of the personal device cache file path.
2561 The LSOFPERSDCPATH variable contents are inserted in the path at the
2563 place marked by the local system administrator with the ``%p'' conver‐
2564 sion in the HASPERSDC format specification of the dialect's machine.h
2565 header file. (It's placed right after the home directory in the de‐
2566 fault lsof distribution.)
2567 Thus, for example, if LSOFPERSDCPATH contains ``LSOF'', the home direc‐
2569 tory is ``/Homes/abe'', the host name is ``lsof.itap.purdue.edu'', and
2570 the HASPERSDC format is the default (``%h/%p.lsof_%L''), the modified
2571 personal device cache file path is:
2572 /Homes/abe/LSOF/.lsof_vic
2574 The LSOFPERSDCPATH environment variable is ignored when the lsof
2576 process is setuid-root or when the real UID of the process is root.
2577 Lsof will not write to a modified personal device cache file path if
2579 the lsof process doesn't surrender setgid permission. (See the LSOF
2580 PERMISSIONS THAT AFFECT DEVICE CACHE FILE ACCESS section for a list of
2581 implementations that normally don't surrender their setgid permission.)
2582 If, for example, you want to create a sub-directory of personal device
2584 cache file paths by using the LSOFPERSDCPATH environment variable to
2585 name it, and lsof doesn't surrender its setgid permission, you will
2586 have to allow lsof to create device cache files at the standard per‐
2587 sonal path and move them to your subdirectory with shell commands.
2588 The local system administrator may: disable this option when lsof is
2590 built; change the name of the environment variable from LSOFPERSDCPATH
2591 to something else; change the HASPERSDC format to include the personal
2592 path component in another place; or exclude the personal path component
2593 entirely. Consult the output of the -D? option for the environment
2594 variable's name and the HASPERSDC format specification.
2595
2597 Errors are identified with messages on the standard error file.
2598 Lsof returns a one (1) if any error was detected, including the failure
2600 to locate command names, file names, Internet addresses or files, login
2601 names, NFS files, PIDs, PGIDs, or UIDs it was asked to list. If the -V
2602 option is specified, lsof will indicate the search items it failed to
2603 list. If the -Q option is specified, lsof will ignore any search item
2604 failures and only return an error if something unusual and unrecover‐
2605 able happened.
2606 It returns a zero (0) if no errors were detected and if either the -Q
2608 option was specified or it was able to list some information about all
2609 the specified search arguments.
2610 When lsof cannot open access to /dev (or /devices) or one of its subdi‐
2612 rectories, or get information on a file in them with stat(2), it issues
2613 a warning message and continues. That lsof will issue warning messages
2614 about inaccessible files in /dev (or /devices) is indicated in its help
2615 output - requested with the -h or >B -? options - with the message:
2616 Inaccessible /dev warnings are enabled.
2618 The warning message may be suppressed with the -w option. It may also
2620 have been suppressed by the system administrator when lsof was compiled
2621 by the setting of the WARNDEVACCESS definition. In this case, the out‐
2622 put from the help options will include the message:
2623 Inaccessible /dev warnings are disabled.
2625 Inaccessible device warning messages usually disappear after lsof has
2627 created a working device cache file.
2628
2630 For a more extensive set of examples, documented more fully, see the
2631 00QUICKSTART file of the lsof distribution.
2632 To list all open files, use:
2634 lsof
2636 To list all open Internet, x.25 (HP-UX), and UNIX domain files, use:
2638 lsof -i -U
2640 To list all open IPv4 network files in use by the process whose PID is
2642 1234, use:
2643 lsof -i 4 -a -p 1234
2645 If it's okay for PID 1234 to not exist, or for PID 1234 to not have any
2647 open IPv4 network files, add -Q :
2648 lsof -Q -i 4 -a -p 1234
2650 Presuming the UNIX dialect supports IPv6, to list only open IPv6 net‐
2652 work files, use:
2653 lsof -i 6
2655 To list all files using any protocol on ports 513, 514, or 515 of host
2657 wonderland.cc.purdue.edu, use:
2658 lsof -i @wonderland.cc.purdue.edu:513-515
2660 To list all files using any protocol on any port of mace.cc.purdue.edu
2662 (cc.purdue.edu is the default domain), use:
2663 lsof -i @mace
2665 To list all open files for login name ``abe'', or user ID 1234, or
2667 process 456, or process 123, or process 789, use:
2668 lsof -p 456,123,789 -u 1234,abe
2670 To list all open files on device /dev/hd4, use:
2672 lsof /dev/hd4
2674 To find the process that has /u/abe/foo open without worrying if there
2676 are none, use:
2677 lsof -Q /u/abe/foo
2679 To take action only if a process has /u/abe/foo open, use:
2681 lsof /u/abe/foo echo "still in use"
2683 To send a SIGHUP to the processes that have /u/abe/bar open, use:
2685 kill -HUP `lsof -t /u/abe/bar`
2687 To find any open file, including an open UNIX domain socket file, with
2689 the name /dev/log, use:
2690 lsof /dev/log
2692 To find processes with open files on the NFS file system named
2694 /nfs/mount/point whose server is inaccessible, and presuming your mount
2695 table supplies the device number for /nfs/mount/point, use:
2696 lsof -b /nfs/mount/point
2698 To do the preceding search with warning messages suppressed, use:
2700 lsof -bw /nfs/mount/point
2702 To ignore the device cache file, use:
2704 lsof -Di
2706 To obtain PID and command name field output for each process, file de‐
2708 scriptor, file device number, and file inode number for each file of
2709 each process, use:
2710 lsof -FpcfDi
2712 To list the files at descriptors 1 and 3 of every process running the
2714 lsof command for login ID ``abe'' every 10 seconds, use:
2715 lsof -c lsof -a -d 1 -d 3 -u abe -r10
2717 To list the current working directory of processes running a command
2719 that is exactly four characters long and has an 'o' or 'O' in character
2720 three, use this regular expression form of the -c c option:
2721 lsof -c /^..o.$/i -a -d cwd
2723 To find an IP version 4 socket file by its associated numeric dot-form
2725 address, use:
2726 lsof -i@128.210.15.17
2728 To find an IP version 6 socket file (when the UNIX dialect supports
2730 IPv6) by its associated numeric colon-form address, use:
2731 lsof -i@[0:1:2:3:4:5:6:7]
2733 To find an IP version 6 socket file (when the UNIX dialect supports
2735 IPv6) by an associated numeric colon-form address that has a run of ze‐
2736 roes in it - e.g., the loop-back address - use:
2737 lsof -i@[::1]
2739 To obtain a repeat mode marker line that contains the current time,
2741 use:
2742 lsof -rm====%T====
2744 To add spaces to the previous marker line, use:
2746 lsof -r "m==== %T ===="
2748
2750 Since lsof reads kernel memory in its search for open files, rapid
2751 changes in kernel memory may produce unpredictable results.
2752 When a file has multiple record locks, the lock status character (fol‐
2754 lowing the file descriptor) is derived from a test of the first lock
2755 structure, not from any combination of the individual record locks that
2756 might be described by multiple lock structures.
2757 Lsof can't search for files with restrictive access permissions by name
2759 unless it is installed with root set-UID permission. Otherwise it is
2760 limited to searching for files to which its user or its set-GID group
2761 (if any) has access permission.
2762 The display of the destination address of a raw socket (e.g., for ping)
2764 depends on the UNIX operating system. Some dialects store the destina‐
2765 tion address in the raw socket's protocol control block, some do not.
2766 Lsof can't always represent Solaris device numbers in the same way that
2768 ls(1) does. For example, the major and minor device numbers that the
2769 lstat(2) and stat(2) functions report for the directory on which CD-ROM
2770 files are mounted (typically /cdrom) are not the same as the ones that
2771 it reports for the device on which CD-ROM files are mounted (typically
2772 /dev/sr0). (Lsof reports the directory numbers.)
2773 The support for /proc file systems is available only for BSD and Tru64
2775 UNIX dialects, Linux, and dialects derived from SYSV R4 - e.g., Free‐
2776 BSD, NetBSD, OpenBSD, Solaris, UnixWare.
2777 Some /proc file items - device number, inode number, and file size -
2779 are unavailable in some dialects. Searching for files in a /proc file
2780 system may require that the full path name be specified.
2781 No text (txt) file descriptors are displayed for Linux processes. All
2783 entries for files other than the current working directory, the root
2784 directory, and numerical file descriptors are labeled mem descriptors.
2785 Lsof can't search for Tru64 UNIX named pipes by name, because their
2787 kernel implementation of lstat(2) returns an improper device number for
2788 a named pipe.
2789 Lsof can't report fully or correctly on HP-UX 9.01, 10.20, and 11.00
2791 locks because of insufficient access to kernel data or errors in the
2792 kernel data. See the lsof FAQ (The FAQ section gives its location.)
2793 for details.
2794 The AIX SMT file type is a fabrication. It's made up for file struc‐
2796 tures whose type (15) isn't defined in the AIX /usr/include/sys/file.h
2797 header file. One way to create such file structures is to run X
2798 clients with the DISPLAY variable set to ``:0.0''.
2799 The +|-f[cfn] option is not supported under /proc-based Linux lsof, be‐
2801 cause it doesn't read kernel structures from kernel memory.
2802
2804 Lsof may access these environment variables.
2805 LANG defines a language locale. See setlocale(3) for the
2807 names of other variables that can be used in place of
2808 LANG - e.g., LC_ALL, LC_TYPE, etc.
2809 LSOFDEVCACHE defines the path to a device cache file. See the DE‐
2811 VICE CACHE PATH FROM AN ENVIRONMENT VARIABLE section
2812 for more information.
2813 LSOFPERSDCPATH defines the middle component of a modified personal
2815 device cache file path. See the MODIFIED PERSONAL
2816 DEVICE CACHE PATH section for more information.
2817
2819 Frequently-asked questions and their answers (an FAQ) are available in
2820 the 00FAQ file of the lsof distribution.
2821 That latest version of the file is found at:
2823 https://github.com/lsof-org/lsof/blob/master/00FAQ
2825
2827 /dev/kmem kernel virtual memory device
2828 /dev/mem physical memory device
2830 /dev/swap system paging device
2832 .lsof_hostname lsof's device cache file (The suffix, hostname, is
2834 the first component of the host's name returned by
2835 gethostname(2).)
2836
2838 Lsof was written by Victor A.Abell <abe@purdue.edu> of Purdue Univer‐
2839 sity. Since version 4.93.0, the lsof-org team at GitHub maintains
2840 lsof. Many others have contributed to lsof. They're listed in the
2841 00CREDITS file of the lsof distribution.
2842
2844 The latest distribution of lsof is available at
2845 https://github.com/lsof-org/lsof/releases
2847
2849 Not all the following manual pages may exist in every UNIX dialect to
2850 which lsof has been ported.
2851 access(2), awk(1), crash(1), fattach(3C), ff(1), fstat(8), fuser(1),
2853 gethostname(2), isprint(3), kill(1), localtime(3), lstat(2), mod‐
2854 load(8), mount(8), netstat(1), ofiles(8L), open(2), perl(1), ps(1),
2855 readlink(2), setlocale(3), stat(2), strftime(3), time(2), uname(1).
2856 Revision-4.96.3 LSOF(1)