1LSOF(1) General Commands Manual LSOF(1)
2
6 lsof - list open files
7
9 lsof [ -?abChlnNOPRtUvVX ] [ -A A ] [ -c c ] [ +c c ] [ +|-d d ] [ +|-D
10 D ] [ +|-e s ] [ +|-E ] [ +|-f [cfgGn] ] [ -F [f] ] [ -g [s] ] [ -i [i]
11 ] [ -k k ] [ -K k ] [ +|-L [l] ] [ +|-m m ] [ +|-M ] [ -o [o] ] [ -p s
12 ] [ +|-r [t[m<fmt>]] ] [ -s [p:s] ] [ -S [t] ] [ -T [t] ] [ -u s ] [
13 +|-w ] [ -x [fl] ] [ -z [z] ] [ -Z [Z] ] [ -- ] [names]
14
16 Lsof revision 4.94.0 lists on its standard output file information
17 about files opened by processes for the following UNIX dialects:
18 Apple Darwin 9 and Mac OS X 10.[567]
20 FreeBSD 8.[234], 9.0 and 1[012].0 for AMD64-based systems
21 Linux 2.1.72 and above for x86-based systems
22 Solaris 9, 10 and 11
23 (See the DISTRIBUTION section of this manual page for information on
25 how to obtain the latest lsof revision.)
26 An open file may be a regular file, a directory, a block special file,
28 a character special file, an executing text reference, a library, a
29 stream or a network file (Internet socket, NFS file or UNIX domain
30 socket.) A specific file or all the files in a file system may be se‐
31 lected by path.
32 Instead of a formatted display, lsof will produce output that can be
34 parsed by other programs. See the -F, option description, and the OUT‐
35 PUT FOR OTHER PROGRAMS section for more information.
36 In addition to producing a single output list, lsof will run in repeat
38 mode. In repeat mode it will produce output, delay, then repeat the
39 output operation until stopped with an interrupt or quit signal. See
40 the +|-r [t[m<fmt>]] option description for more information.
41
43 In the absence of any options, lsof lists all open files belonging to
44 all active processes.
45 If any list request option is specified, other list requests must be
47 specifically requested - e.g., if -U is specified for the listing of
48 UNIX socket files, NFS files won't be listed unless -N is also speci‐
49 fied; or if a user list is specified with the -u option, UNIX domain
50 socket files, belonging to users not in the list, won't be listed un‐
51 less the -U option is also specified.
52 Normally list options that are specifically stated are ORed - i.e.,
54 specifying the -i option without an address and the -ufoo option pro‐
55 duces a listing of all network files OR files belonging to processes
56 owned by user ``foo''. The exceptions are:
57 1) the `^' (negated) login name or user ID (UID), specified with the -u
59 option;
60 2) the `^' (negated) process ID (PID), specified with the -p option;
62 3) the `^' (negated) process group ID (PGID), specified with the -g op‐
64 tion;
65 4) the `^' (negated) command, specified with the -c option;
67 5) the (`^') negated TCP or UDP protocol state names, specified with
69 the -s [p:s] option.
70 Since they represent exclusions, they are applied without ORing or AND‐
72 ing and take effect before any other selection criteria are applied.
73 The -a option may be used to AND the selections. For example, specify‐
75 ing -a, -U, and -ufoo produces a listing of only UNIX socket files that
76 belong to processes owned by user ``foo''.
77 Caution: the -a option causes all list selection options to be ANDed;
79 it can't be used to cause ANDing of selected pairs of selection options
80 by placing it between them, even though its placement there is accept‐
81 able. Wherever -a is placed, it causes the ANDing of all selection op‐
82 tions.
83 Items of the same selection set - command names, file descriptors, net‐
85 work addresses, process identifiers, user identifiers, zone names, se‐
86 curity contexts - are joined in a single ORed set and applied before
87 the result participates in ANDing. Thus, for example, specifying
88 -i@aaa.bbb, -i@ccc.ddd, -a, and -ufff,ggg will select the listing of
89 files that belong to either login ``fff'' OR ``ggg'' AND have network
90 connections to either host aaa.bbb OR ccc.ddd.
91 Options may be grouped together following a single prefix -- e.g., the
93 option set ``-a -b -C'' may be stated as -abC. However, since values
94 are optional following +|-f, -F, -g, -i, +|-L, -o, +|-r, -s, -S, -T, -x
95 and -z. when you have no values for them be careful that the following
96 character isn't ambiguous. For example, -Fn might represent the -F and
97 -n options, or it might represent the n field identifier character fol‐
98 lowing the -F option. When ambiguity is possible, start a new option
99 with a `-' character - e.g., ``-F -n''. If the next option is a file
100 name, follow the possibly ambiguous option with ``--'' - e.g., ``-F --
101 name''.
102 Either the `+' or the `-' prefix may be applied to a group of options.
104 Options that don't take on separate meanings for each prefix - e.g., -i
105 - may be grouped under either prefix. Thus, for example, ``+M -i'' may
106 be stated as ``+Mi'' and the group means the same as the separate op‐
107 tions. Be careful of prefix grouping when one or more options in the
108 group does take on separate meanings under different prefixes - e.g.,
109 +|-M; ``-iM'' is not the same request as ``-i +M''. When in doubt, use
110 separate options with appropriate prefixes.
111 -? -h These two equivalent options select a usage (help) output
113 list. Lsof displays a shortened form of this output when it
114 detects an error in the options supplied to it, after it has
115 displayed messages explaining each error. (Escape the `?'
116 character as your shell requires.)
117 -a causes list selection options to be ANDed, as described above.
119 -A A is available on systems configured for AFS whose AFS kernel
121 code is implemented via dynamic modules. It allows the lsof
122 user to specify A as an alternate name list file where the
123 kernel addresses of the dynamic modules might be found. See
124 the lsof FAQ (The FAQ section gives its location.) for more
125 information about dynamic modules, their symbols, and how they
126 affect lsof.
127 -b causes lsof to avoid kernel functions that might block -
129 lstat(2), readlink(2), and stat(2).
130 See the BLOCKS AND TIMEOUTS and AVOIDING KERNEL BLOCKS sec‐
132 tions for information on using this option.
133 -c c selects the listing of files for processes executing the com‐
135 mand that begins with the characters of c. Multiple commands
136 may be specified, using multiple -c options. They are joined
137 in a single ORed set before participating in AND option selec‐
138 tion.
139 If c begins with a `^', then the following characters specify
141 a command name whose processes are to be ignored (excluded.)
142 If c begins and ends with a slash ('/'), the characters be‐
144 tween the slashes are interpreted as a regular expression.
145 Shell meta-characters in the regular expression must be quoted
146 to prevent their interpretation by the shell. The closing
147 slash may be followed by these modifiers:
148 b the regular expression is a basic one.
150 i ignore the case of letters.
151 x the regular expression is an extended one
152 (default).
153 See the lsof FAQ (The FAQ section gives its location.) for
155 more information on basic and extended regular expressions.
156 The simple command specification is tested first. If that
158 test fails, the command regular expression is applied. If the
159 simple command test succeeds, the command regular expression
160 test isn't made. This may result in ``no command found for
161 regex:'' messages when lsof's -V option is specified.
162 +c w defines the maximum number of initial characters of the name,
164 supplied by the UNIX dialect, of the UNIX command associated
165 with a process to be printed in the COMMAND column. (The lsof
166 default is nine.)
167 Note that many UNIX dialects do not supply all command name
169 characters to lsof in the files and structures from which lsof
170 obtains command name. Often dialects limit the number of
171 characters supplied in those sources. For example, Linux
172 2.4.27 and Solaris 9 both limit command name length to 16
173 characters.
174 If w is zero ('0'), all command characters supplied to lsof by
176 the UNIX dialect will be printed.
177 If w is less than the length of the column title, ``COMMAND'',
179 it will be raised to that length.
180 -C disables the reporting of any path name components from the
182 kernel's name cache. See the KERNEL NAME CACHE section for
183 more information.
184 +d s causes lsof to search for all open instances of directory s
186 and the files and directories it contains at its top level.
187 +d does NOT descend the directory tree, rooted at s. The +D D
188 option may be used to request a full-descent directory tree
189 search, rooted at directory D.
190 Processing of the +d option does not follow symbolic links
192 within s unless the -x or -x l option is also specified. Nor
193 does it search for open files on file system mount points on
194 subdirectories of s unless the -x or -x f option is also
195 specified.
196 Note: the authority of the user of this option limits it to
198 searching for files that the user has permission to examine
199 with the system stat(2) function.
200 -d s specifies a list of file descriptors (FDs) to exclude from or
202 include in the output listing. The file descriptors are spec‐
203 ified in the comma-separated set s - e.g., ``cwd,1,3'',
204 ``^6,^2''. (There should be no spaces in the set.)
205 The list is an exclusion list if all entries of the set begin
207 with `^'. It is an inclusion list if no entry begins with
208 `^'. Mixed lists are not permitted.
209 A file descriptor number range may be in the set as long as
211 neither member is empty, both members are numbers, and the
212 ending member is larger than the starting one - e.g., ``0-7''
213 or ``3-10''. Ranges may be specified for exclusion if they
214 have the `^' prefix - e.g., ``^0-7'' excludes all file de‐
215 scriptors 0 through 7.
216 Multiple file descriptor numbers are joined in a single ORed
218 set before participating in AND option selection.
219 When there are exclusion and inclusion members in the set,
221 lsof reports them as errors and exits with a non-zero return
222 code.
223 See the description of File Descriptor (FD) output values in
225 the OUTPUT section for more information on file descriptor
226 names.
227 fd is a pseudo file descriptor name for specifying the whole
229 range of possible file descriptor numbers. fd does not appear
230 in FD column of output.
231 +D D causes lsof to search for all open instances of directory D
233 and all the files and directories it contains to its complete
234 depth.
235 Processing of the +D option does not follow symbolic links
237 within D unless the -x or -x l option is also specified. Nor
238 does it search for open files on file system mount points on
239 subdirectories of D unless the -x or -x f option is also
240 specified.
241 Note: the authority of the user of this option limits it to
243 searching for files that the user has permission to examine
244 with the system stat(2) function.
245 Further note: lsof may process this option slowly and require
247 a large amount of dynamic memory to do it. This is because it
248 must descend the entire directory tree, rooted at D, calling
249 stat(2) for each file and directory, building a list of all
250 the files it finds, and searching that list for a match with
251 every open file. When directory D is large, these steps can
252 take a long time, so use this option prudently.
253 -D D directs lsof's use of the device cache file. The use of this
255 option is sometimes restricted. See the DEVICE CACHE FILE
256 section and the sections that follow it for more information
257 on this option.
258 -D must be followed by a function letter; the function letter
260 may optionally be followed by a path name. Lsof recognizes
261 these function letters:
262 ? - report device cache file paths
264 b - build the device cache file
265 i - ignore the device cache file
266 r - read the device cache file
267 u - read and update the device cache file
268 The b, r, and u functions, accompanied by a path name, are
270 sometimes restricted. When these functions are restricted,
271 they will not appear in the description of the -D option that
272 accompanies -h or -? option output. See the DEVICE CACHE
273 FILE section and the sections that follow it for more informa‐
274 tion on these functions and when they're restricted.
275 The ? function reports the read-only and write paths that
277 lsof can use for the device cache file, the names of any envi‐
278 ronment variables whose values lsof will examine when forming
279 the device cache file path, and the format for the personal
280 device cache file path. (Escape the `?' character as your
281 shell requires.)
282 When available, the b, r, and u functions may be followed by
284 the device cache file's path. The standard default is
285 .lsof_hostname in the home directory of the real user ID that
286 executes lsof, but this could have been changed when lsof was
287 configured and compiled. (The output of the -h and -? op‐
288 tions show the current default prefix - e.g., ``.lsof''.) The
289 suffix, hostname, is the first component of the host's name
290 returned by gethostname(2).
291 When available, the b function directs lsof to build a new de‐
293 vice cache file at the default or specified path.
294 The i function directs lsof to ignore the default device cache
296 file and obtain its information about devices via direct calls
297 to the kernel.
298 The r function directs lsof to read the device cache at the
300 default or specified path, but prevents it from creating a new
301 device cache file when none exists or the existing one is im‐
302 properly structured. The r function, when specified without a
303 path name, prevents lsof from updating an incorrect or out‐
304 dated device cache file, or creating a new one in its place.
305 The r function is always available when it is specified with‐
306 out a path name argument; it may be restricted by the permis‐
307 sions of the lsof process.
308 When available, the u function directs lsof to read the device
310 cache file at the default or specified path, if possible, and
311 to rebuild it, if necessary. This is the default device cache
312 file function when no -D option has been specified.
313 +|-e s exempts the file system whose path name is s from being sub‐
315 jected to kernel function calls that might block. The +e op‐
316 tion exempts stat(2), lstat(2) and most readlink(2) kernel
317 function calls. The -e option exempts only stat(2) and
318 lstat(2) kernel function calls. Multiple file systems may be
319 specified with separate +|-e specifications and each may have
320 readlink(2) calls exempted or not.
321 This option is currently implemented only for Linux.
323 CAUTION: this option can easily be mis-applied to other than
325 the file system of interest, because it uses path name rather
326 than the more reliable device and inode numbers. (Device and
327 inode numbers are acquired via the potentially blocking
328 stat(2) kernel call and are thus not available, but see the
329 +|-m m option as a possible alternative way to supply device
330 numbers.) Use this option with great care and fully specify
331 the path name of the file system to be exempted.
332 When open files on exempted file systems are reported, it may
334 not be possible to obtain all their information. Therefore,
335 some information columns will be blank, the characters
336 ``UNKN'' preface the values in the TYPE column, and the appli‐
337 cable exemption option is added in parentheses to the end of
338 the NAME column. (Some device number information might be
339 made available via the +|-m m option.)
340 +|-E +E specifies that Linux pipe, Linux UNIX socket, Linux INET(6)
342 socket closed in a local host, Linux pseudoterminal files,
343 POSIX Message Queueue implementation in Linux, and Linux
344 eventfd should be displayed with endpoint information and the
345 files of the endpoints should also be displayed.
346 Note 1: UNIX socket file endpoint information is only avail‐
348 able when the compile flags line of -v output contains HASUX‐
349 SOCKEPT, and psudoterminal endpoint information is only avail‐
350 able when the compile flags line contains HASPTYEPT.
351 Note 2: POSIX Message Queue file endpoint information is only
353 available when mqueue file system is mounted.
354 Pipe endpoint information is displayed in the NAME column in
356 the form ``PID,cmd,FDmode'', where PID is the endpoint process
357 ID; cmd is the endpoint process command; FD is the endpoint
358 file's descriptor; and mode is the endpoint file's access
359 mode.
360 Pseudoterminal endpoint information is displayed in the NAME
362 column as ``->/dev/ptsmin PID,cmd,FDmode'' or ``PID,cmd,FD‐
363 mode''. The first form is for a master device; the second,
364 for a slave device. min is a slave device's minor device num‐
365 ber; and PID, cmd, FD and mode are the same as with pipe end‐
366 point information. Note: psudoterminal endpoint information
367 is only available when the compile flags line of -V output
368 contains HASPTYEPT. In addition, this feature works on Linux
369 kernels above 4.13.0.
370 UNIX socket file endpoint information is displayed in the NAME
372 column in the form
373 ``type=TYPE ->INO=INODE PID,cmd,FDmode'', where TYPE is the
374 socket type; INODE is the i-node number of the connected
375 socket; and PID, cmd, FD and mode are the same as with pipe
376 endpoint information. Note: UNIX socket file endpoint infor‐
377 mation is available only when the compile flags line of -v
378 output contains HASUXSOCKEPT.
379 INET socket file endpoint information is inserted to the value
381 at the NAME column in th form
382 PID, cmd, FD and mode are the same as with pipe endpoint in‐
383 formation. The endpoint information is available only if the
384 socket is used for local IPC; both endpoints bind to the same
385 local IPv4 or IPv6 address.
386 POSIX Message Queue file endpoint information is displayed in
388 the NAME column in the same form as that of pipe.
389 eventfd endpoint information is displayed in the NAME column
391 in the same form as that of pipe. This feature works on Linux
392 kernels above 5.2.0.
393 Multiple occurrences of this information can appear in a
395 file's NAME column.
396 -E specfies that endpoint supported files should be displayed
398 with endpoint information, but not the files of the endpoints.
399 +|-f [cfgGn]
401 f by itself clarifies how path name arguments are to be inter‐
402 preted. When followed by c, f, g, G, or n in any combination
403 it specifies that the listing of kernel file structure infor‐
404 mation is to be enabled (`+') or inhibited (`-').
405 Normally a path name argument is taken to be a file system
407 name if it matches a mounted-on directory name reported by
408 mount(8), or if it represents a block device, named in the
409 mount output and associated with a mounted directory name.
410 When +f is specified, all path name arguments will be taken to
411 be file system names, and lsof will complain if any are not.
412 This can be useful, for example, when the file system name
413 (mounted-on device) isn't a block device. This happens for
414 some CD-ROM file systems.
415 When -f is specified by itself, all path name arguments will
417 be taken to be simple files. Thus, for example, the ``-f --
418 /'' arguments direct lsof to search for open files with a `/'
419 path name, not all open files in the `/' (root) file system.
420 Be careful to make sure +f and -f are properly terminated and
422 aren't followed by a character (e.g., of the file or file sys‐
423 tem name) that might be taken as a parameter. For example,
424 use ``--'' after +f and -f as in these examples.
425 $ lsof +f -- /file/system/name
427 $ lsof -f -- /file/name
428 The listing of information from kernel file structures, re‐
430 quested with the +f [cfgGn] option form, is normally inhib‐
431 ited, and is not available in whole or part for some dialects
432 - e.g., /proc-based Linux kernels below 2.6.22. When the pre‐
433 fix to f is a plus sign (`+'), these characters request file
434 structure information:
435 c file structure use count (not Linux)
437 f file structure address (not Linux)
438 g file flag abbreviations (Linux 2.6.22 and up)
439 Abbrev. Flag in C code (see open(2))
441 W O_WRONLY
443 RW O_RDWR
444 CR O_CREAT
445 EXCL O_EXCL
446 NTTY O_NOCTTY
447 TR O_TRUNC
448 AP O_APPEND
449 ND O_NDELAY
450 SYN O_SYNC
451 ASYN O_ASYNC
452 DIR O_DIRECT
453 DTY O_DIRECTORY
454 NFLK O_NOFOLLOW
455 NATM O_NOATIME
456 DSYN O_DSYNC
457 RSYN O_RSYNC
458 LG O_LARGEFILE
459 CX O_CLOEXEC
460 TMPF O_TMPFILE
461 G file flags in hexadecimal (Linux 2.6.22 and up)
463 n file structure node address (not Linux)
464 When the prefix is minus (`-') the same characters disable the
466 listing of the indicated values.
467 File structure addresses, use counts, flags, and node ad‐
469 dresses may be used to detect more readily identical files in‐
470 herited by child processes and identical files in use by dif‐
471 ferent processes. Lsof column output can be sorted by output
472 columns holding the values and listed to identify identical
473 file use, or lsof field output can be parsed by an AWK or Perl
474 post-filter script, or by a C program.
475 -F f specifies a character list, f, that selects the fields to be
477 output for processing by another program, and the character
478 that terminates each output field. Each field to be output is
479 specified with a single character in f. The field terminator
480 defaults to NL, but may be changed to NUL (000). See the OUT‐
481 PUT FOR OTHER PROGRAMS section for a description of the field
482 identification characters and the field output process.
483 When the field selection character list is empty, all standard
485 fields are selected (except the raw device field, security
486 context and zone field for compatibility reasons) and the NL
487 field terminator is used.
488 When the field selection character list contains only a zero
490 (`0'), all fields are selected (except the raw device field
491 for compatibility reasons) and the NUL terminator character is
492 used.
493 Other combinations of fields and their associated field termi‐
495 nator character must be set with explicit entries in f, as de‐
496 scribed in the OUTPUT FOR OTHER PROGRAMS section.
497 When a field selection character identifies an item lsof does
499 not normally list - e.g., PPID, selected with -R - specifica‐
500 tion of the field character - e.g., ``-FR'' - also selects the
501 listing of the item.
502 When the field selection character list contains the single
504 character `?', lsof will display a help list of the field
505 identification characters. (Escape the `?' character as your
506 shell requires.)
507 -g [s] excludes or selects the listing of files for the processes
509 whose optional process group IDentification (PGID) numbers are
510 in the comma-separated set s - e.g., ``123'' or ``123,^456''.
511 (There should be no spaces in the set.)
512 PGID numbers that begin with `^' (negation) represent exclu‐
514 sions.
515 Multiple PGID numbers are joined in a single ORed set before
517 participating in AND option selection. However, PGID exclu‐
518 sions are applied without ORing or ANDing and take effect be‐
519 fore other selection criteria are applied.
520 The -g option also enables the output display of PGID numbers.
522 When specified without a PGID set that's all it does.
523 -i [i] selects the listing of files any of whose Internet address
525 matches the address specified in i. If no address is speci‐
526 fied, this option selects the listing of all Internet and x.25
527 (HP-UX) network files.
528 If -i4 or -i6 is specified with no following address, only
530 files of the indicated IP version, IPv4 or IPv6, are dis‐
531 played. (An IPv6 specification may be used only if the di‐
532 alects supports IPv6, as indicated by ``[46]'' and ``IPv[46]''
533 in lsof's -h or -? output.) Sequentially specifying -i4,
534 followed by -i6 is the same as specifying -i, and vice-versa.
535 Specifying -i4, or -i6 after -i is the same as specifying -i4
536 or -i6 by itself.
537 Multiple addresses (up to a limit of 100) may be specified
539 with multiple -i options. (A port number or service name
540 range is counted as one address.) They are joined in a single
541 ORed set before participating in AND option selection.
542 An Internet address is specified in the form (Items in square
544 brackets are optional.):
545 [46][protocol][@hostname|hostaddr][:service|port]
547 where:
549 46 specifies the IP version, IPv4 or IPv6
550 that applies to the following address.
551 '6' may be be specified only if the UNIX
552 dialect supports IPv6. If neither '4' nor
553 '6' is specified, the following address
554 applies to all IP versions.
555 protocol is a protocol name - TCP, UDP
556 hostname is an Internet host name. Unless a
557 specific IP version is specified, open
558 network files associated with host names
559 of all versions will be selected.
560 hostaddr is a numeric Internet IPv4 address in
561 dot form; or an IPv6 numeric address in
562 colon form, enclosed in brackets, if the
563 UNIX dialect supports IPv6. When an IP
564 version is selected, only its numeric
565 addresses may be specified.
566 service is an /etc/services name - e.g., smtp -
567 or a list of them.
568 port is a port number, or a list of them.
569 IPv6 options may be used only if the UNIX dialect supports
571 IPv6. To see if the dialect supports IPv6, run lsof and spec‐
572 ify the -h or -? (help) option. If the displayed description
573 of the -i option contains ``[46]'' and ``IPv[46]'', IPv6 is
574 supported.
575 IPv4 host names and addresses may not be specified if network
577 file selection is limited to IPv6 with -i 6. IPv6 host names
578 and addresses may not be specified if network file selection
579 is limited to IPv4 with -i 4. When an open IPv4 network
580 file's address is mapped in an IPv6 address, the open file's
581 type will be IPv6, not IPv4, and its display will be selected
582 by '6', not '4'.
583 At least one address component - 4, 6, protocol, hostname,
585 hostaddr, or service - must be supplied. The `@' character,
586 leading the host specification, is always required; as is the
587 `:', leading the port specification. Specify either hostname
588 or hostaddr. Specify either service name list or port number
589 list. If a service name list is specified, the protocol may
590 also need to be specified if the TCP, UDP and UDPLITE port
591 numbers for the service name are different. Use any case -
592 lower or upper - for protocol.
593 Service names and port numbers may be combined in a list whose
595 entries are separated by commas and whose numeric range en‐
596 tries are separated by minus signs. There may be no embedded
597 spaces, and all service names must belong to the specified
598 protocol. Since service names may contain embedded minus
599 signs, the starting entry of a range can't be a service name;
600 it can be a port number, however.
601 Here are some sample addresses:
603 -i6 - IPv6 only
605 TCP:25 - TCP and port 25
606 @1.2.3.4 - Internet IPv4 host address 1.2.3.4
607 @[3ffe:1ebc::1]:1234 - Internet IPv6 host address
608 3ffe:1ebc::1, port 1234
609 UDP:who - UDP who service port
610 TCP@lsof.itap:513 - TCP, port 513 and host name lsof.itap
611 tcp@foo:1-10,smtp,99 - TCP, ports 1 through 10,
612 service name smtp, port 99, host name foo
613 tcp@bar:1-smtp - TCP, ports 1 through smtp, host bar
614 :time - either TCP, UDP or UDPLITE time service port
615 -K k selects the listing of tasks (threads) of processes, on di‐
617 alects where task (thread) reporting is supported. (If help
618 output - i.e., the output of the -h or -? options - shows
619 this option, then task (thread) reporting is supported by the
620 dialect.)
621 If -K is followed by a value, k, it must be ``i''. That
623 causes lsof to ignore tasks, particularly in the default,
624 list-everything case when no other options are specified.
625 When -K and -a are both specified on Linux, and the tasks of a
627 main process are selected by other options, the main process
628 will also be listed as though it were a task, but without a
629 task ID. (See the description of the TID column in the OUTPUT
630 section.)
631 Where the FreeBSD version supports threads, all threads will
633 be listed with their IDs.
634 In general threads and tasks inherit the files of the caller,
636 but may close some and open others, so lsof always reports all
637 the open files of threads and tasks.
638 -k k specifies a kernel name list file, k, in place of /vmunix,
640 /mach, etc. -k is not available under AIX on the IBM
641 RISC/System 6000.
642 -l inhibits the conversion of user ID numbers to login names. It
644 is also useful when login name lookup is working improperly or
645 slowly.
646 +|-L [l] enables (`+') or disables (`-') the listing of file link
648 counts, where they are available - e.g., they aren't available
649 for sockets, or most FIFOs and pipes.
650 When +L is specified without a following number, all link
652 counts will be listed. When -L is specified (the default), no
653 link counts will be listed.
654 When +L is followed by a number, only files having a link
656 count less than that number will be listed. (No number may
657 follow -L.) A specification of the form ``+L1'' will select
658 open files that have been unlinked. A specification of the
659 form ``+aL1 <file_system>'' will select unlinked open files on
660 the specified file system.
661 For other link count comparisons, use field output (-F) and a
663 post-processing script or program.
664 +|-m m specifies an alternate kernel memory file or activates mount
666 table supplement processing.
667 The option form -m m specifies a kernel memory file, m, in
669 place of /dev/kmem or /dev/mem - e.g., a crash dump file.
670 The option form +m requests that a mount supplement file be
672 written to the standard output file. All other options are
673 silently ignored.
674 There will be a line in the mount supplement file for each
676 mounted file system, containing the mounted file system direc‐
677 tory, followed by a single space, followed by the device num‐
678 ber in hexadecimal "0x" format - e.g.,
679 / 0x801
681 Lsof can use the mount supplement file to get device numbers
683 for file systems when it can't get them via stat(2) or
684 lstat(2).
685 The option form +m m identifies m as a mount supplement file.
687 Note: the +m and +m m options are not available for all sup‐
689 ported dialects. Check the output of lsof's -h or -? options
690 to see if the +m and +m m options are available.
691 +|-M Enables (+) or disables (-) the reporting of portmapper regis‐
693 trations for local TCP, UDP and UDPLITE ports, where port map‐
694 ping is supported. (See the last paragraph of this option de‐
695 scription for information about where portmapper registration
696 reporting is supported.)
697 The default reporting mode is set by the lsof builder with the
699 HASPMAPENABLED #define in the dialect's machine.h header file;
700 lsof is distributed with the HASPMAPENABLED #define deacti‐
701 vated, so portmapper reporting is disabled by default and must
702 be requested with +M. Specifying lsof's -h or -? option will
703 report the default mode. Disabling portmapper registration
704 when it is already disabled or enabling it when already en‐
705 abled is acceptable. When portmapper registration reporting
706 is enabled, lsof displays the portmapper registration (if any)
707 for local TCP, UDP or UDPLITE ports in square brackets immedi‐
708 ately following the port numbers or service names - e.g.,
709 ``:1234[name]'' or ``:name[100083]''. The registration infor‐
710 mation may be a name or number, depending on what the regis‐
711 tering program supplied to the portmapper when it registered
712 the port.
713 When portmapper registration reporting is enabled, lsof may
715 run a little more slowly or even become blocked when access to
716 the portmapper becomes congested or stopped. Reverse the re‐
717 porting mode to determine if portmapper registration reporting
718 is slowing or blocking lsof.
719 For purposes of portmapper registration reporting lsof consid‐
721 ers a TCP, UDP or UDPLITE port local if: it is found in the
722 local part of its containing kernel structure; or if it is lo‐
723 cated in the foreign part of its containing kernel structure
724 and the local and foreign Internet addresses are the same; or
725 if it is located in the foreign part of its containing kernel
726 structure and the foreign Internet address is INADDR_LOOPBACK
727 (127.0.0.1). This rule may make lsof ignore some foreign
728 ports on machines with multiple interfaces when the foreign
729 Internet address is on a different interface from the local
730 one.
731 See the lsof FAQ (The FAQ section gives its location.) for
733 further discussion of portmapper registration reporting is‐
734 sues.
735 Portmapper registration reporting is supported only on di‐
737 alects that have RPC header files. (Some Linux distributions
738 with GlibC 2.14 do not have them.) When portmapper registra‐
739 tion reporting is supported, the -h or -? help output will
740 show the +|-M option.
741 -n inhibits the conversion of network numbers to host names for
743 network files. Inhibiting conversion may make lsof run
744 faster. It is also useful when host name lookup is not work‐
745 ing properly.
746 -N selects the listing of NFS files.
748 -o directs lsof to display file offset at all times. It causes
750 the SIZE/OFF output column title to be changed to OFFSET.
751 Note: on some UNIX dialects lsof can't obtain accurate or con‐
752 sistent file offset information from its kernel data sources,
753 sometimes just for particular kinds of files (e.g., socket
754 files.) Consult the lsof FAQ (The FAQ section gives its loca‐
755 tion.) for more information.
756 The -o and -s options are mutually exclusive; they can't both
758 be specified. When neither is specified, lsof displays what‐
759 ever value - size or offset - is appropriate and available for
760 the type of the file.
761 -o o defines the number of decimal digits (o) to be printed after
763 the ``0t'' for a file offset before the form is switched to
764 ``0x...''. An o value of zero (unlimited) directs lsof to use
765 the ``0t'' form for all offset output.
766 This option does NOT direct lsof to display offset at all
768 times; specify -o (without a trailing number) to do that. -o
769 o only specifies the number of digits after ``0t'' in either
770 mixed size and offset or offset-only output. Thus, for exam‐
771 ple, to direct lsof to display offset at all times with a dec‐
772 imal digit count of 10, use:
773 -o -o 10
775 or
776 -oo10
777 The default number of digits allowed after ``0t'' is normally
779 8, but may have been changed by the lsof builder. Consult the
780 description of the -o o option in the output of the -h or -?
781 option to determine the default that is in effect.
782 -O directs lsof to bypass the strategy it uses to avoid being
784 blocked by some kernel operations - i.e., doing them in forked
785 child processes. See the BLOCKS AND TIMEOUTS and AVOIDING
786 KERNEL BLOCKS sections for more information on kernel opera‐
787 tions that may block lsof.
788 While use of this option will reduce lsof startup overhead, it
790 may also cause lsof to hang when the kernel doesn't respond to
791 a function. Use this option cautiously.
792 -p s excludes or selects the listing of files for the processes
794 whose optional process IDentification (PID) numbers are in the
795 comma-separated set s - e.g., ``123'' or ``123,^456''. (There
796 should be no spaces in the set.)
797 PID numbers that begin with `^' (negation) represent exclu‐
799 sions.
800 Multiple process ID numbers are joined in a single ORed set
802 before participating in AND option selection. However, PID
803 exclusions are applied without ORing or ANDing and take effect
804 before other selection criteria are applied.
805 -P inhibits the conversion of port numbers to port names for net‐
807 work files. Inhibiting the conversion may make lsof run a
808 little faster. It is also useful when port name lookup is not
809 working properly.
810 +|-r [t[c<N>][m<fmt>]]
812 puts lsof in repeat mode. There lsof lists open files as se‐
813 lected by other options, delays t seconds (default fifteen),
814 then repeats the listing, delaying and listing repetitively
815 until stopped by a condition defined by the prefix to the op‐
816 tion.
817 If the prefix is a `-', repeat mode is endless. Lsof must be
819 terminated with an interrupt or quit signal. `c<N>' is for
820 specifying the limits of repeating; if the number of itera‐
821 tions reaches at `<N>', Lsof stops itself.
822 If the prefix is `+', repeat mode will end the first cycle no
824 open files are listed - and of course when lsof is stopped
825 with an interrupt or quit signal. When repeat mode ends be‐
826 cause no files are listed, the process exit code will be zero
827 if any open files were ever listed; one, if none were ever
828 listed.
829 Lsof marks the end of each listing: if field output is in
831 progress (the -F, option has been specified), the default
832 marker is `m'; otherwise the default marker is ``========''.
833 The marker is followed by a NL character.
834 The optional "m<fmt>" argument specifies a format for the
836 marker line. The <fmt> characters following `m' are inter‐
837 preted as a format specification to the strftime(3) function,
838 when both it and the localtime(3) function are available in
839 the dialect's C library. Consult the strftime(3) documenta‐
840 tion for what may appear in its format specification. Note
841 that when field output is requested with the -F option, <fmt>
842 cannot contain the NL format, ``%n''. Note also that when
843 <fmt> contains spaces or other characters that affect the
844 shell's interpretation of arguments, <fmt> must be quoted ap‐
845 propriately.
846 Repeat mode reduces lsof startup overhead, so it is more effi‐
848 cient to use this mode than to call lsof repetitively from a
849 shell script, for example.
850 To use repeat mode most efficiently, accompany +|-r with spec‐
852 ification of other lsof selection options, so the amount of
853 kernel memory access lsof does will be kept to a minimum. Op‐
854 tions that filter at the process level - e.g., -c, -g, -p, -u
855 - are the most efficient selectors.
856 Repeat mode is useful when coupled with field output (see the
858 -F, option description) and a supervising awk or Perl script,
859 or a C program.
860 -R directs lsof to list the Parent Process IDentification number
862 in the PPID column.
863 -s [p:s] s alone directs lsof to display file size at all times. It
865 causes the SIZE/OFF output column title to be changed to SIZE.
866 If the file does not have a size, nothing is displayed.
867 The optional -s p:s form is available only for selected di‐
869 alects, and only when the -h or -? help output lists it.
870 When the optional form is available, the s may be followed by
872 a protocol name (p), either TCP or UDP, a colon (`:') and a
873 comma-separated protocol state name list, the option causes
874 open TCP and UDP files to be excluded if their state name(s)
875 are in the list (s) preceded by a `^'; or included if their
876 name(s) are not preceded by a `^'.
877 Dialects that support this option may support only one proto‐
879 col. When an unsupported protocol is specified, a message
880 will be displayed indicating state names for the protocol are
881 unavailable.
882 When an inclusion list is defined, only network files with
884 state names in the list will be present in the lsof output.
885 Thus, specifying one state name means that only network files
886 with that lone state name will be listed.
887 Case is unimportant in the protocol or state names, but there
889 may be no spaces and the colon (`:') separating the protocol
890 name (p) and the state name list (s) is required.
891 If only TCP and UDP files are to be listed, as controlled by
893 the specified exclusions and inclusions, the -i option must be
894 specified, too. If only a single protocol's files are to be
895 listed, add its name as an argument to the -i option.
896 For example, to list only network files with TCP state LISTEN,
898 use:
899 -iTCP -sTCP:LISTEN
901 Or, for example, to list network files with all UDP states ex‐
903 cept Idle, use:
904 -iUDP -sUDP:^Idle
906 State names vary with UNIX dialects, so it's not possible to
908 provide a complete list. Some common TCP state names are:
909 CLOSED, IDLE, BOUND, LISTEN, ESTABLISHED, SYN_SENT, SYN_RCDV,
910 ESTABLISHED, CLOSE_WAIT, FIN_WAIT1, CLOSING, LAST_ACK,
911 FIN_WAIT_2, and TIME_WAIT. Two common UDP state names are Un‐
912 bound and Idle.
913 See the lsof FAQ (The FAQ section gives its location.) for
915 more information on how to use protocol state exclusion and
916 inclusion, including examples.
917 The -o (without a following decimal digit count) and -s option
919 (without a following protocol and state name list) are mutu‐
920 ally exclusive; they can't both be specified. When neither is
921 specified, lsof displays whatever value - size or offset - is
922 appropriate and available for the type of file.
923 Since some types of files don't have true sizes - sockets, FI‐
925 FOs, pipes, etc. - lsof displays for their sizes the content
926 amounts in their associated kernel buffers, if possible.
927 -S [t] specifies an optional time-out seconds value for kernel func‐
929 tions - lstat(2), readlink(2), and stat(2) - that might other‐
930 wise deadlock. The minimum for t is two; the default, fif‐
931 teen; when no value is specified, the default is used.
932 See the BLOCKS AND TIMEOUTS section for more information.
934 -T [t] controls the reporting of some TCP/TPI information, also re‐
936 ported by netstat(1), following the network addresses. In
937 normal output the information appears in parentheses, each
938 item except TCP or TPI state name identified by a keyword,
939 followed by `=', separated from others by a single space:
940 <TCP or TPI state name>
942 QR=<read queue length>
943 QS=<send queue length>
944 SO=<socket options and values>
945 SS=<socket states>
946 TF=<TCP flags and values>
947 WR=<window read length>
948 WW=<window write length>
949 Not all values are reported for all UNIX dialects. Items val‐
951 ues (when available) are reported after the item name and '='.
952 When the field output mode is in effect (See OUTPUT FOR OTHER
954 PROGRAMS.) each item appears as a field with a `T' leading
955 character.
956 -T with no following key characters disables TCP/TPI informa‐
958 tion reporting.
959 -T with following characters selects the reporting of specific
961 TCP/TPI information:
962 f selects reporting of socket options,
964 states and values, and TCP flags and
965 values.
966 q selects queue length reporting.
967 s selects connection state reporting.
968 w selects window size reporting.
969 Not all selections are enabled for some UNIX dialects. State
971 may be selected for all dialects and is reported by default.
972 The -h or -? help output for the -T option will show what se‐
973 lections may be used with the UNIX dialect.
974 When -T is used to select information - i.e., it is followed
976 by one or more selection characters - the displaying of state
977 is disabled by default, and it must be explicitly selected
978 again in the characters following -T. (In effect, then, the
979 default is equivalent to -Ts.) For example, if queue lengths
980 and state are desired, use -Tqs.
981 Socket options, socket states, some socket values, TCP flags
983 and one TCP value may be reported (when available in the UNIX
984 dialect) in the form of the names that commonly appear after
985 SO_, so_, SS_, TCP_ and TF_ in the dialect's header files -
986 most often <sys/socket.h>, <sys/socketvar.h> and
987 <netinet/tcp_var.h>. Consult those header files for the mean‐
988 ing of the flags, options, states and values.
989 ``SO='' precedes socket options and values; ``SS='', socket
991 states; and ``TF='', TCP flags and values.
992 If a flag or option has a value, the value will follow an '='
994 and the name -- e.g., ``SO=LINGER=5'', ``SO=QLIM=5'',
995 ``TF=MSS=512''. The following seven values may be reported:
996 Name
998 Reported Description (Common Symbol)
999 KEEPALIVE keep alive time (SO_KEEPALIVE)
1001 LINGER linger time (SO_LINGER)
1002 MSS maximum segment size (TCP_MAXSEG)
1003 PQLEN partial listen queue connections
1004 QLEN established listen queue connections
1005 QLIM established listen queue limit
1006 RCVBUF receive buffer length (SO_RCVBUF)
1007 SNDBUF send buffer length (SO_SNDBUF)
1008 Details on what socket options and values, socket states, and
1010 TCP flags and values may be displayed for particular UNIX di‐
1011 alects may be found in the answer to the ``Why doesn't lsof
1012 report socket options, socket states, and TCP flags and values
1013 for my dialect?'' and ``Why doesn't lsof report the partial
1014 listen queue connection count for my dialect?'' questions in
1015 the lsof FAQ (The FAQ section gives its location.) On Linux
1016 this option also prints the state of UNIX domain sockets.
1017 -t produce terse output comprising only process identifiers
1019 (without a header), so that it is easy to use programmati‐
1020 cally. e.g.
1021 # reload anything using old SSL
1023 lsof -t /lib/*/libssl.so.* | xargs -r kill -HUP
1024 # get list of processes and then iterate over them (Bash only)
1026 mapfile -t pids < <(
1027 lsof -wt /var/log/your.log
1028 )
1029 for pid in "${pids[@]}" ; do
1030 your_command -p "$pid"
1031 done
1032 The -t option implies the -w option.
1034 -u s selects the listing of files for the user whose login names or
1036 user ID numbers are in the comma-separated set s - e.g.,
1037 ``abe'', or ``548,root''. (There should be no spaces in the
1038 set.)
1039 Multiple login names or user ID numbers are joined in a single
1041 ORed set before participating in AND option selection.
1042 If a login name or user ID is preceded by a `^', it becomes a
1044 negation - i.e., files of processes owned by the login name or
1045 user ID will never be listed. A negated login name or user ID
1046 selection is neither ANDed nor ORed with other selections; it
1047 is applied before all other selections and absolutely excludes
1048 the listing of the files of the process. For example, to di‐
1049 rect lsof to exclude the listing of files belonging to root
1050 processes, specify ``-u^root'' or ``-u^0''.
1051 -U selects the listing of UNIX domain socket files.
1053 -v selects the listing of lsof version information, including:
1055 revision number; when the lsof binary was constructed; who
1056 constructed the binary and where; the name of the compiler
1057 used to construct the lsof binary; the version number of the
1058 compiler when readily available; the compiler and loader flags
1059 used to construct the lsof binary; and system information,
1060 typically the output of uname's -a option.
1061 -V directs lsof to indicate the items it was asked to list and
1063 failed to find - command names, file names, Internet addresses
1064 or files, login names, NFS files, PIDs, PGIDs, and UIDs.
1065 When other options are ANDed to search options, or com‐
1067 pile-time options restrict the listing of some files, lsof may
1068 not report that it failed to find a search item when an ANDed
1069 option or compile-time option prevents the listing of the open
1070 file containing the located search item.
1071 For example, ``lsof -V -iTCP@foobar -a -d 999'' may not report
1073 a failure to locate open files at ``TCP@foobar'' and may not
1074 list any, if none have a file descriptor number of 999. A
1075 similar situation arises when HASSECURITY and HASNOSOCKSECU‐
1076 RITY are defined at compile time and they prevent the listing
1077 of open files.
1078 +|-w Enables (+) or disables (-) the suppression of warning mes‐
1080 sages.
1081 The lsof builder may choose to have warning messages disabled
1083 or enabled by default. The default warning message state is
1084 indicated in the output of the -h or -? option. Disabling
1085 warning messages when they are already disabled or enabling
1086 them when already enabled is acceptable.
1087 The -t option implies the -w option.
1089 -x [fl] may accompany the +d and +D options to direct their processing
1091 to cross over symbolic links and|or file system mount points
1092 encountered when scanning the directory (+d) or directory tree
1093 (+D).
1094 If -x is specified by itself without a following parameter,
1096 cross-over processing of both symbolic links and file system
1097 mount points is enabled. Note that when -x is specified with‐
1098 out a parameter, the next argument must begin with '-' or '+'.
1099 The optional 'f' parameter enables file system mount point
1101 cross-over processing; 'l', symbolic link cross-over process‐
1102 ing.
1103 The -x option may not be supplied without also supplying a +d
1105 or +D option.
1106 -X This is a dialect-specific option.
1108 AIX:
1110 This IBM AIX RISC/System 6000 option requests the reporting of
1111 executed text file and shared library references.
1112 WARNING: because this option uses the kernel readx() function,
1114 its use on a busy AIX system might cause an application
1115 process to hang so completely that it can neither be killed
1116 nor stopped. I have never seen this happen or had a report of
1117 its happening, but I think there is a remote possibility it
1118 could happen.
1119 By default use of readx() is disabled. On AIX 5L and above
1121 lsof may need setuid-root permission to perform the actions
1122 this option requests.
1123 The lsof builder may specify that the -X option be restricted
1125 to processes whose real UID is root. If that has been done,
1126 the -X option will not appear in the -h or -? help output un‐
1127 less the real UID of the lsof process is root. The default
1128 lsof distribution allows any UID to specify -X, so by default
1129 it will appear in the help output.
1130 When AIX readx() use is disabled, lsof may not be able to re‐
1132 port information for all text and loader file references, but
1133 it may also avoid exacerbating an AIX kernel directory search
1134 kernel error, known as the Stale Segment ID bug.
1135 The readx() function, used by lsof or any other program to ac‐
1137 cess some sections of kernel virtual memory, can trigger the
1138 Stale Segment ID bug. It can cause the kernel's dir_search()
1139 function to believe erroneously that part of an in-memory copy
1140 of a file system directory has been zeroed. Another applica‐
1141 tion process, distinct from lsof, asking the kernel to search
1142 the directory - e.g., by using open(2) - can cause
1143 dir_search() to loop forever, thus hanging the application
1144 process.
1145 Consult the lsof FAQ (The FAQ section gives its location.)
1147 and the 00README file of the lsof distribution for a more com‐
1148 plete description of the Stale Segment ID bug, its APAR, and
1149 methods for defining readx() use when compiling lsof.
1150 Linux:
1152 This Linux option requests that lsof skip the reporting of in‐
1153 formation on all open TCP, UDP and UDPLITE IPv4 and IPv6
1154 files.
1155 This Linux option is most useful when the system has an ex‐
1157 tremely large number of open TCP, UDP and UDPLITE files, the
1158 processing of whose information in the /proc/net/tcp* and
1159 /proc/net/udp* files would take lsof a long time, and whose
1160 reporting is not of interest.
1161 Use this option with care and only when you are sure that the
1163 information you want lsof to display isn't associated with
1164 open TCP, UDP or UDPLITE socket files.
1165 Solaris 10 and above:
1167 This Solaris 10 and above option requests the reporting of
1168 cached paths for files that have been deleted - i.e., removed
1169 with rm(1) or unlink(2).
1170 The cached path is followed by the string `` (deleted)'' to
1172 indicate that the path by which the file was opened has been
1173 deleted.
1174 Because intervening changes made to the path - i.e., renames
1176 with mv(1) or rename(2) - are not recorded in the cached path,
1177 what lsof reports is only the path by which the file was
1178 opened, not its possibly different final path.
1179 -z [z] specifies how Solaris 10 and higher zone information is to be
1181 handled.
1182 Without a following argument - e.g., NO z - the option speci‐
1184 fies that zone names are to be listed in the ZONE output col‐
1185 umn.
1186 The -z option may be followed by a zone name, z. That causes
1188 lsof to list only open files for processes in that zone. Mul‐
1189 tiple -z z option and argument pairs may be specified to form
1190 a list of named zones. Any open file of any process in any of
1191 the zones will be listed, subject to other conditions speci‐
1192 fied by other options and arguments.
1193 -Z [Z] specifies how SELinux security contexts are to be handled. It
1195 and 'Z' field output character support are inhibited when
1196 SELinux is disabled in the running Linux kernel. See OUTPUT
1197 FOR OTHER PROGRAMS for more information on the 'Z' field out‐
1198 put character.
1199 Without a following argument - e.g., NO Z - the option speci‐
1201 fies that security contexts are to be listed in the SECU‐
1202 RITY-CONTEXT output column.
1203 The -Z option may be followed by a wildcard security context
1205 name, Z. That causes lsof to list only open files for pro‐
1206 cesses in that security context. Multiple -Z Z option and ar‐
1207 gument pairs may be specified to form a list of security con‐
1208 texts. Any open file of any process in any of the security
1209 contexts will be listed, subject to other conditions specified
1210 by other options and arguments. Note that Z can be A:B:C or
1211 *:B:C or A:B:* or *:*:C to match against the A:B:C context.
1212 -- The double minus sign option is a marker that signals the end
1214 of the keyed options. It may be used, for example, when the
1215 first file name begins with a minus sign. It may also be used
1216 when the absence of a value for the last keyed option must be
1217 signified by the presence of a minus sign in the following op‐
1218 tion and before the start of the file names.
1219 names These are path names of specific files to list. Symbolic
1221 links are resolved before use. The first name may be sepa‐
1222 rated from the preceding options with the ``--'' option.
1223 If a name is the mounted-on directory of a file system or the
1225 device of the file system, lsof will list all the files open
1226 on the file system. To be considered a file system, the name
1227 must match a mounted-on directory name in mount(8) output, or
1228 match the name of a block device associated with a mounted-on
1229 directory name. The +|-f option may be used to force lsof to
1230 consider a name a file system identifier (+f) or a simple file
1231 (-f).
1232 If name is a path to a directory that is not the mounted-on
1234 directory name of a file system, it is treated just as a regu‐
1235 lar file is treated - i.e., its listing is restricted to pro‐
1236 cesses that have it open as a file or as a process-specific
1237 directory, such as the root or current working directory. To
1238 request that lsof look for open files inside a directory name,
1239 use the +d s and +D D options.
1240 If a name is the base name of a family of multiplexed files -
1242 e.g, AIX's /dev/pt[cs] - lsof will list all the associated
1243 multiplexed files on the device that are open - e.g.,
1244 /dev/pt[cs]/1, /dev/pt[cs]/2, etc.
1245 If a name is a UNIX domain socket name, lsof will usually
1247 search for it by the characters of the name alone - exactly as
1248 it is specified and is recorded in the kernel socket struc‐
1249 ture. (See the next paragraph for an exception to that rule
1250 for Linux.) Specifying a relative path - e.g., ./file - in
1251 place of the file's absolute path - e.g., /tmp/file - won't
1252 work because lsof must match the characters you specify with
1253 what it finds in the kernel UNIX domain socket structures.
1254 If a name is a Linux UNIX domain socket name, in one case lsof
1256 is able to search for it by its device and inode number, al‐
1257 lowing name to be a relative path. The case requires that the
1258 absolute path -- i.e., one beginning with a slash ('/') be
1259 used by the process that created the socket, and hence be
1260 stored in the /proc/net/unix file; and it requires that lsof
1261 be able to obtain the device and node numbers of both the ab‐
1262 solute path in /proc/net/unix and name via successful stat(2)
1263 system calls. When those conditions are met, lsof will be
1264 able to search for the UNIX domain socket when some path to it
1265 is is specified in name. Thus, for example, if the path is
1266 /dev/log, and an lsof search is initiated when the working di‐
1267 rectory is /dev, then name could be ./log.
1268 If a name is none of the above, lsof will list any open files
1270 whose device and inode match that of the specified path name.
1271 If you have also specified the -b option, the only names you
1273 may safely specify are file systems for which your mount table
1274 supplies alternate device numbers. See the AVOIDING KERNEL
1275 BLOCKS and ALTERNATE DEVICE NUMBERS sections for more informa‐
1276 tion.
1277 Multiple file names are joined in a single ORed set before
1279 participating in AND option selection.
1280
1282 Lsof supports the recognition of AFS files for these dialects (and AFS
1283 versions):
1284 AIX 4.1.4 (AFS 3.4a)
1286 HP-UX 9.0.5 (AFS 3.4a)
1287 Linux 1.2.13 (AFS 3.3)
1288 Solaris 2.[56] (AFS 3.4a)
1289 It may recognize AFS files on other versions of these dialects, but has
1291 not been tested there. Depending on how AFS is implemented, lsof may
1292 recognize AFS files in other dialects, or may have difficulties recog‐
1293 nizing AFS files in the supported dialects.
1294 Lsof may have trouble identifying all aspects of AFS files in supported
1296 dialects when AFS kernel support is implemented via dynamic modules
1297 whose addresses do not appear in the kernel's variable name list. In
1298 that case, lsof may have to guess at the identity of AFS files, and
1299 might not be able to obtain volume information from the kernel that is
1300 needed for calculating AFS volume node numbers. When lsof can't com‐
1301 pute volume node numbers, it reports blank in the NODE column.
1302 The -A A option is available in some dialect implementations of lsof
1304 for specifying the name list file where dynamic module kernel addresses
1305 may be found. When this option is available, it will be listed in the
1306 lsof help output, presented in response to the -h or -?
1307 See the lsof FAQ (The FAQ section gives its location.) for more infor‐
1309 mation about dynamic modules, their symbols, and how they affect lsof
1310 options.
1311 Because AFS path lookups don't seem to participate in the kernel's name
1313 cache operations, lsof can't identify path name components for AFS
1314 files.
1315
1317 Lsof has three features that may cause security concerns. First, its
1318 default compilation mode allows anyone to list all open files with it.
1319 Second, by default it creates a user-readable and user-writable device
1320 cache file in the home directory of the real user ID that executes
1321 lsof. (The list-all-open-files and device cache features may be dis‐
1322 abled when lsof is compiled.) Third, its -k and -m options name alter‐
1323 nate kernel name list or memory files.
1324 Restricting the listing of all open files is controlled by the com‐
1326 pile-time HASSECURITY and HASNOSOCKSECURITY options. When HASSECURITY
1327 is defined, lsof will allow only the root user to list all open files.
1328 The non-root user may list only open files of processes with the same
1329 user IDentification number as the real user ID number of the lsof
1330 process (the one that its user logged on with).
1331 However, if HASSECURITY and HASNOSOCKSECURITY are both defined, anyone
1333 may list open socket files, provided they are selected with the -i op‐
1334 tion.
1335 When HASSECURITY is not defined, anyone may list all open files.
1337 Help output, presented in response to the -h or -? option, gives the
1339 status of the HASSECURITY and HASNOSOCKSECURITY definitions.
1340 See the Security section of the 00README file of the lsof distribution
1342 for information on building lsof with the HASSECURITY and HASNOSOCKSE‐
1343 CURITY options enabled.
1344 Creation and use of a user-readable and user-writable device cache file
1346 is controlled by the compile-time HASDCACHE option. See the DEVICE
1347 CACHE FILE section and the sections that follow it for details on how
1348 its path is formed. For security considerations it is important to
1349 note that in the default lsof distribution, if the real user ID under
1350 which lsof is executed is root, the device cache file will be written
1351 in root's home directory - e.g., / or /root. When HASDCACHE is not de‐
1352 fined, lsof does not write or attempt to read a device cache file.
1353 When HASDCACHE is defined, the lsof help output, presented in response
1355 to the -h, -D?, or -? options, will provide device cache file handling
1356 information. When HASDCACHE is not defined, the -h or -? output will
1357 have no -D option description.
1358 Before you decide to disable the device cache file feature - enabling
1360 it improves the performance of lsof by reducing the startup overhead of
1361 examining all the nodes in /dev (or /devices) - read the discussion of
1362 it in the 00DCACHE file of the lsof distribution and the lsof FAQ (The
1363 FAQ section gives its location.)
1364 WHEN IN DOUBT, YOU CAN TEMPORARILY DISABLE THE USE OF THE DEVICE CACHE
1366 FILE WITH THE -Di OPTION.
1367 When lsof user declares alternate kernel name list or memory files with
1369 the -k and -m options, lsof checks the user's authority to read them
1370 with access(2). This is intended to prevent whatever special power
1371 lsof's modes might confer on it from letting it read files not normally
1372 accessible via the authority of the real user ID.
1373
1375 This section describes the information lsof lists for each open file.
1376 See the OUTPUT FOR OTHER PROGRAMS section for additional information on
1377 output that can be processed by another program.
1378 Lsof only outputs printable (declared so by isprint(3)) 8 bit charac‐
1380 ters. Non-printable characters are printed in one of three forms: the
1381 C ``\[bfrnt]'' form; the control character `^' form (e.g., ``^@''); or
1382 hexadecimal leading ``\x'' form (e.g., ``\xab''). Space is non-print‐
1383 able in the COMMAND column (``\x20'') and printable elsewhere.
1384 For some dialects - if HASSETLOCALE is defined in the dialect's ma‐
1386 chine.h header file - lsof will print the extended 8 bit characters of
1387 a language locale. The lsof process must be supplied a language locale
1388 environment variable (e.g., LANG) whose value represents a known lan‐
1389 guage locale in which the extended characters are considered printable
1390 by isprint(3). Otherwise lsof considers the extended characters
1391 non-printable and prints them according to its rules for non-printable
1392 characters, stated above. Consult your dialect's setlocale(3) man page
1393 for the names of other environment variables that may be used in place
1394 of LANG - e.g., LC_ALL, LC_CTYPE, etc.
1395 Lsof's language locale support for a dialect also covers wide charac‐
1397 ters - e.g., UTF-8 - when HASSETLOCALE and HASWIDECHAR are defined in
1398 the dialect's machine.h header file, and when a suitable language lo‐
1399 cale has been defined in the appropriate environment variable for the
1400 lsof process. Wide characters are printable under those conditions if
1401 iswprint(3) reports them to be. If HASSETLOCALE, HASWIDECHAR and a
1402 suitable language locale aren't defined, or if iswprint(3) reports wide
1403 characters that aren't printable, lsof considers the wide characters
1404 non-printable and prints each of their 8 bits according to its rules
1405 for non-printable characters, stated above.
1406 Consult the answers to the "Language locale support" questions in the
1408 lsof FAQ (The FAQ section gives its location.) for more information.
1409 Lsof dynamically sizes the output columns each time it runs, guarantee‐
1411 ing that each column is a minimum size. It also guarantees that each
1412 column is separated from its predecessor by at least one space.
1413 COMMAND contains the first nine characters of the name of the UNIX
1415 command associated with the process. If a non-zero w value
1416 is specified to the +c w option, the column contains the
1417 first w characters of the name of the UNIX command associ‐
1418 ated with the process up to the limit of characters supplied
1419 to lsof by the UNIX dialect. (See the description of the +c
1420 w command or the lsof FAQ for more information. The FAQ
1421 section gives its location.)
1422 If w is less than the length of the column title, ``COM‐
1424 MAND'', it will be raised to that length.
1425 If a zero w value is specified to the +c w option, the col‐
1427 umn contains all the characters of the name of the UNIX com‐
1428 mand associated with the process.
1429 All command name characters maintained by the kernel in its
1431 structures are displayed in field output when the command
1432 name descriptor (`c') is specified. See the OUTPUT FOR
1433 OTHER COMMANDS section for information on selecting field
1434 output and the associated command name descriptor.
1435 PID is the Process IDentification number of the process.
1437 TID is the task (thread) IDentification number, if task (thread)
1439 reporting is supported by the dialect and a task (thread) is
1440 being listed. (If help output - i.e., the output of the -h
1441 or -? options - shows this option, then task (thread) re‐
1442 porting is supported by the dialect.)
1443 A blank TID column in Linux indicates a process - i.e., a
1445 non-task.
1446 TASKCMD is the task command name. Generally this will be the same
1448 as the process named in the COMMAND column, but some task
1449 implementations (e.g., Linux) permit a task to change its
1450 command name.
1451 The TASKCMD column width is subject to the same size limita‐
1453 tion as the COMMAND column.
1454 ZONE is the Solaris 10 and higher zone name. This column must be
1456 selected with the -z option.
1457 SECURITY-CONTEXT
1459 is the SELinux security context. This column must be se‐
1460 lected with the -Z option. Note that the -Z option is in‐
1461 hibited when SELinux is disabled in the running Linux ker‐
1462 nel.
1463 PPID is the Parent Process IDentification number of the process.
1465 It is only displayed when the -R option has been specified.
1466 PGID is the process group IDentification number associated with
1468 the process. It is only displayed when the -g option has
1469 been specified.
1470 USER is the user ID number or login name of the user to whom the
1472 process belongs, usually the same as reported by ps(1).
1473 However, on Linux USER is the user ID number or login that
1474 owns the directory in /proc where lsof finds information
1475 about the process. Usually that is the same value reported
1476 by ps(1), but may differ when the process has changed its
1477 effective user ID. (See the -l option description for in‐
1478 formation on when a user ID number or login name is dis‐
1479 played.)
1480 FD is the File Descriptor number of the file or:
1482 cwd current working directory;
1484 Lnn library references (AIX);
1485 err FD information error (see NAME column);
1486 jld jail directory (FreeBSD);
1487 ltx shared library text (code and data);
1488 Mxx hex memory-mapped type number xx.
1489 m86 DOS Merge mapped file;
1490 mem memory-mapped file;
1491 mmap memory-mapped device;
1492 pd parent directory;
1493 rtd root directory;
1494 tr kernel trace file (OpenBSD);
1495 txt program text (code and data);
1496 v86 VP/ix mapped file;
1497 FD is followed by one of these characters, describing the
1499 mode under which the file is open:
1500 r for read access;
1502 w for write access;
1503 u for read and write access;
1504 space if mode unknown and no lock
1505 character follows;
1506 `-' if mode unknown and lock
1507 character follows.
1508 The mode character is followed by one of these lock charac‐
1510 ters, describing the type of lock applied to the file:
1511 N for a Solaris NFS lock of unknown type;
1513 r for read lock on part of the file;
1514 R for a read lock on the entire file;
1515 w for a write lock on part of the file;
1516 W for a write lock on the entire file;
1517 u for a read and write lock of any length;
1518 U for a lock of unknown type;
1519 x for an SCO OpenServer Xenix lock on part of the
1520 file;
1521 X for an SCO OpenServer Xenix lock on the entire file;
1522 space if there is no lock.
1523 See the LOCKS section for more information on the lock in‐
1525 formation character.
1526 The FD column contents constitutes a single field for pars‐
1528 ing in post-processing scripts.
1529 TYPE is the type of the node associated with the file - e.g.,
1531 GDIR, GREG, VDIR, VREG, etc.
1532 or ``IPv4'' for an IPv4 socket;
1534 or ``IPv6'' for an open IPv6 network file - even if its ad‐
1536 dress is IPv4, mapped in an IPv6 address;
1537 or ``ax25'' for a Linux AX.25 socket;
1539 or ``inet'' for an Internet domain socket;
1541 or ``lla'' for a HP-UX link level access file;
1543 or ``rte'' for an AF_ROUTE socket;
1545 or ``sock'' for a socket of unknown domain;
1547 or ``unix'' for a UNIX domain socket;
1549 or ``x.25'' for an HP-UX x.25 socket;
1551 or ``BLK'' for a block special file;
1553 or ``CHR'' for a character special file;
1555 or ``DEL'' for a Linux map file that has been deleted;
1557 or ``DIR'' for a directory;
1559 or ``DOOR'' for a VDOOR file;
1561 or ``FIFO'' for a FIFO special file;
1563 or ``KQUEUE'' for a BSD style kernel event queue file;
1565 or ``LINK'' for a symbolic link file;
1567 or ``MPB'' for a multiplexed block file;
1569 or ``MPC'' for a multiplexed character file;
1571 or ``NOFD'' for a Linux /proc/<PID>/fd directory that can't
1573 be opened -- the directory path appears in the NAME column,
1574 followed by an error message;
1575 or ``PAS'' for a /proc/as file;
1577 or ``PAXV'' for a /proc/auxv file;
1579 or ``PCRE'' for a /proc/cred file;
1581 or ``PCTL'' for a /proc control file;
1583 or ``PCUR'' for the current /proc process;
1585 or ``PCWD'' for a /proc current working directory;
1587 or ``PDIR'' for a /proc directory;
1589 or ``PETY'' for a /proc executable type (etype);
1591 or ``PFD'' for a /proc file descriptor;
1593 or ``PFDR'' for a /proc file descriptor directory;
1595 or ``PFIL'' for an executable /proc file;
1597 or ``PFPR'' for a /proc FP register set;
1599 or ``PGD'' for a /proc/pagedata file;
1601 or ``PGID'' for a /proc group notifier file;
1603 or ``PIPE'' for pipes;
1605 or ``PLC'' for a /proc/lwpctl file;
1607 or ``PLDR'' for a /proc/lpw directory;
1609 or ``PLDT'' for a /proc/ldt file;
1611 or ``PLPI'' for a /proc/lpsinfo file;
1613 or ``PLST'' for a /proc/lstatus file;
1615 or ``PLU'' for a /proc/lusage file;
1617 or ``PLWG'' for a /proc/gwindows file;
1619 or ``PLWI'' for a /proc/lwpsinfo file;
1621 or ``PLWS'' for a /proc/lwpstatus file;
1623 or ``PLWU'' for a /proc/lwpusage file;
1625 or ``PLWX'' for a /proc/xregs file;
1627 or ``PMAP'' for a /proc map file (map);
1629 or ``PMEM'' for a /proc memory image file;
1631 or ``PNTF'' for a /proc process notifier file;
1633 or ``POBJ'' for a /proc/object file;
1635 or ``PODR'' for a /proc/object directory;
1637 or ``POLP'' for an old format /proc light weight process
1639 file;
1640 or ``POPF'' for an old format /proc PID file;
1642 or ``POPG'' for an old format /proc page data file;
1644 or ``PORT'' for a SYSV named pipe;
1646 or ``PREG'' for a /proc register file;
1648 or ``PRMP'' for a /proc/rmap file;
1650 or ``PRTD'' for a /proc root directory;
1652 or ``PSGA'' for a /proc/sigact file;
1654 or ``PSIN'' for a /proc/psinfo file;
1656 or ``PSTA'' for a /proc status file;
1658 or ``PSXMQ'' for a POSIX message queue file;
1660 or ``PSXSEM'' for a POSIX semaphore file;
1662 or ``PSXSHM'' for a POSIX shared memory file;
1664 or ``PTS'' for a /dev/pts file;
1666 or ``PUSG'' for a /proc/usage file;
1668 or ``PW'' for a /proc/watch file;
1670 or ``PXMP'' for a /proc/xmap file;
1672 or ``REG'' for a regular file;
1674 or ``SMT'' for a shared memory transport file;
1676 or ``STSO'' for a stream socket;
1678 or ``UNNM'' for an unnamed type file;
1680 or ``XNAM'' for an OpenServer Xenix special file of unknown
1682 type;
1683 or ``XSEM'' for an OpenServer Xenix semaphore file;
1685 or ``XSD'' for an OpenServer Xenix shared data file;
1687 or the four type number octets if the corresponding name
1689 isn't known.
1690 FILE-ADDR contains the kernel file structure address when f has been
1692 specified to +f;
1693 FCT contains the file reference count from the kernel file
1695 structure when c has been specified to +f;
1696 FILE-FLAG when g or G has been specified to +f, this field contains
1698 the contents of the f_flag[s] member of the kernel file
1699 structure and the kernel's per-process open file flags (if
1700 available); `G' causes them to be displayed in hexadecimal;
1701 `g', as short-hand names; two lists may be displayed with
1702 entries separated by commas, the lists separated by a semi‐
1703 colon (`;'); the first list may contain short-hand names for
1704 f_flag[s] values from the following table:
1705 AIO asynchronous I/O (e.g., FAIO)
1707 AP append
1708 ASYN asynchronous I/O (e.g., FASYNC)
1709 BAS block, test, and set in use
1710 BKIU block if in use
1711 BL use block offsets
1712 BSK block seek
1713 CA copy avoid
1714 CIO concurrent I/O
1715 CLON clone
1716 CLRD CL read
1717 CR create
1718 DF defer
1719 DFI defer IND
1720 DFLU data flush
1721 DIR direct
1722 DLY delay
1723 DOCL do clone
1724 DSYN data-only integrity
1725 DTY must be a directory
1726 EVO event only
1727 EX open for exec
1728 EXCL exclusive open
1729 FSYN synchronous writes
1730 GCDF defer during unp_gc() (AIX)
1731 GCMK mark during unp_gc() (AIX)
1732 GTTY accessed via /dev/tty
1733 HUP HUP in progress
1734 KERN kernel
1735 KIOC kernel-issued ioctl
1736 LCK has lock
1737 LG large file
1738 MBLK stream message block
1739 MK mark
1740 MNT mount
1741 MSYN multiplex synchronization
1742 NATM don't update atime
1743 NB non-blocking I/O
1744 NBDR no BDRM check
1745 NBIO SYSV non-blocking I/O
1746 NBF n-buffering in effect
1747 NC no cache
1748 ND no delay
1749 NDSY no data synchronization
1750 NET network
1751 NFLK don't follow links
1752 NMFS NM file system
1753 NOTO disable background stop
1754 NSH no share
1755 NTTY no controlling TTY
1756 OLRM OLR mirror
1757 PAIO POSIX asynchronous I/O
1758 PATH path
1759 PP POSIX pipe
1760 R read
1761 RC file and record locking cache
1762 REV revoked
1763 RSH shared read
1764 RSYN read synchronization
1765 RW read and write access
1766 SL shared lock
1767 SNAP cooked snapshot
1768 SOCK socket
1769 SQSH Sequent shared set on open
1770 SQSV Sequent SVM set on open
1771 SQR Sequent set repair on open
1772 SQS1 Sequent full shared open
1773 SQS2 Sequent partial shared open
1774 STPI stop I/O
1775 SWR synchronous read
1776 SYN file integrity while writing
1777 TCPM avoid TCP collision
1778 TMPF temporary file
1779 TR truncate
1780 W write
1781 WKUP parallel I/O synchronization
1782 WTG parallel I/O synchronization
1783 VH vhangup pending
1784 VTXT virtual text
1785 XL exclusive lock
1786 this list of names was derived from F* #define's in dialect
1788 header files <fcntl.h>, <linux</fs.h>, <sys/fcntl.c>,
1789 <sys/fcntlcom.h>, and <sys/file.h>; see the lsof.h header
1790 file for a list showing the correspondence between the above
1791 short-hand names and the header file definitions;
1792 the second list (after the semicolon) may contain short-hand
1794 names for kernel per-process open file flags from this ta‐
1795 ble:
1796 ALLC allocated
1798 BR the file has been read
1799 BHUP activity stopped by SIGHUP
1800 BW the file has been written
1801 CLSG closing
1802 CX close-on-exec (see fcntl(F_SETFD))
1803 LCK lock was applied
1804 MP memory-mapped
1805 OPIP open pending - in progress
1806 RSVW reserved wait
1807 SHMT UF_FSHMAT set (AIX)
1808 USE in use (multi-threaded)
1809 NODE-ID (or INODE-ADDR for some dialects) contains a unique identi‐
1811 fier for the file node (usually the kernel vnode or inode
1812 address, but also occasionally a concatenation of device and
1813 node number) when n has been specified to +f;
1814 DEVICE contains the device numbers, separated by commas, for a
1816 character special, block special, regular, directory or NFS
1817 file;
1818 or ``memory'' for a memory file system node under Tru64
1820 UNIX;
1821 or the address of the private data area of a Solaris socket
1823 stream;
1824 or a kernel reference address that identifies the file (The
1826 kernel reference address may be used for FIFO's, for exam‐
1827 ple.);
1828 or the base address or device name of a Linux AX.25 socket
1830 device.
1831 Usually only the lower thirty two bits of Tru64 UNIX kernel
1833 addresses are displayed.
1834 SIZE, SIZE/OFF, or OFFSET
1836 is the size of the file or the file offset in bytes. A
1837 value is displayed in this column only if it is available.
1838 Lsof displays whatever value - size or offset - is appropri‐
1839 ate for the type of the file and the version of lsof.
1840 On some UNIX dialects lsof can't obtain accurate or consis‐
1842 tent file offset information from its kernel data sources,
1843 sometimes just for particular kinds of files (e.g., socket
1844 files.) In other cases, files don't have true sizes - e.g.,
1845 sockets, FIFOs, pipes - so lsof displays for their sizes the
1846 content amounts it finds in their kernel buffer descriptors
1847 (e.g., socket buffer size counts or TCP/IP window sizes.)
1848 Consult the lsof FAQ (The FAQ section gives its location.)
1849 for more information.
1850 The file size is displayed in decimal; the offset is nor‐
1852 mally displayed in decimal with a leading ``0t'' if it con‐
1853 tains 8 digits or less; in hexadecimal with a leading ``0x''
1854 if it is longer than 8 digits. (Consult the -o o option de‐
1855 scription for information on when 8 might default to some
1856 other value.)
1857 Thus the leading ``0t'' and ``0x'' identify an offset when
1859 the column may contain both a size and an offset (i.e., its
1860 title is SIZE/OFF).
1861 If the -o option is specified, lsof always displays the file
1863 offset (or nothing if no offset is available) and labels the
1864 column OFFSET. The offset always begins with ``0t'' or
1865 ``0x'' as described above.
1866 The lsof user can control the switch from ``0t'' to ``0x''
1868 with the -o o option. Consult its description for more in‐
1869 formation.
1870 If the -s option is specified, lsof always displays the file
1872 size (or nothing if no size is available) and labels the
1873 column SIZE. The -o and -s options are mutually exclusive;
1874 they can't both be specified.
1875 For files that don't have a fixed size - e.g., don't reside
1877 on a disk device - lsof will display appropriate information
1878 about the current size or position of the file if it is
1879 available in the kernel structures that define the file.
1880 NLINK contains the file link count when +L has been specified;
1882 NODE is the node number of a local file;
1884 or the inode number of an NFS file in the server host;
1886 or the Internet protocol type - e.g, ``TCP'';
1888 or ``STR'' for a stream;
1890 or ``CCITT'' for an HP-UX x.25 socket;
1892 or the IRQ or inode number of a Linux AX.25 socket device.
1894 NAME is the name of the mount point and file system on which the
1896 file resides;
1897 or the name of a file specified in the names option (after
1899 any symbolic links have been resolved);
1900 or the name of a character special or block special device;
1902 or the local and remote Internet addresses of a network
1904 file; the local host name or IP number is followed by a
1905 colon (':'), the port, ``->'', and the two-part remote ad‐
1906 dress; IP addresses may be reported as numbers or names, de‐
1907 pending on the +|-M, -n, and -P options; colon-separated
1908 IPv6 numbers are enclosed in square brackets; IPv4 IN‐
1909 ADDR_ANY and IPv6 IN6_IS_ADDR_UNSPECIFIED addresses, and
1910 zero port numbers are represented by an asterisk ('*'); a
1911 UDP destination address may be followed by the amount of
1912 time elapsed since the last packet was sent to the destina‐
1913 tion; TCP, UDP and UDPLITE remote addresses may be followed
1914 by TCP/TPI information in parentheses - state (e.g., ``(ES‐
1915 TABLISHED)'', ``(Unbound)''), queue sizes, and window sizes
1916 (not all dialects) - in a fashion similar to what netstat(1)
1917 reports; see the -T option description or the description of
1918 the TCP/TPI field in OUTPUT FOR OTHER PROGRAMS for more in‐
1919 formation on state, queue size, and window size;
1920 or the address or name of a UNIX domain socket, possibly in‐
1922 cluding a stream clone device name, a file system object's
1923 path name, local and foreign kernel addresses, socket pair
1924 information, and a bound vnode address;
1925 or the local and remote mount point names of an NFS file;
1927 or ``STR'', followed by the stream name;
1929 or a stream character device name, followed by ``->'' and
1931 the stream name or a list of stream module names, separated
1932 by ``->'';
1933 or ``STR:'' followed by the SCO OpenServer stream device and
1935 module names, separated by ``->'';
1936 or system directory name, `` -- '', and as many components
1938 of the path name as lsof can find in the kernel's name cache
1939 for selected dialects (See the KERNEL NAME CACHE section for
1940 more information.);
1941 or ``PIPE->'', followed by a Solaris kernel pipe destination
1943 address;
1944 or ``COMMON:'', followed by the vnode device information
1946 structure's device name, for a Solaris common vnode;
1947 or the address family, followed by a slash (`/'), followed
1949 by fourteen comma-separated bytes of a non-Internet raw
1950 socket address;
1951 or the HP-UX x.25 local address, followed by the virtual
1953 connection number (if any), followed by the remote address
1954 (if any);
1955 or ``(dead)'' for disassociated Tru64 UNIX files - typically
1957 terminal files that have been flagged with the TIOCNOTTY
1958 ioctl and closed by daemons;
1959 or ``rd=<offset>'' and ``wr=<offset>'' for the values of the
1961 read and write offsets of a FIFO;
1962 or ``clone n:/dev/event'' for SCO OpenServer file clones of
1964 the /dev/event device, where n is the minor device number of
1965 the file;
1966 or ``(socketpair: n)'' for a Solaris 2.6, 8, 9 or 10 UNIX
1968 domain socket, created by the socketpair(3N) network func‐
1969 tion;
1970 or ``no PCB'' for socket files that do not have a protocol
1972 block associated with them, optionally followed by ``,
1973 CANTSENDMORE'' if sending on the socket has been disabled,
1974 or ``, CANTRCVMORE'' if receiving on the socket has been
1975 disabled (e.g., by the shutdown(2) function);
1976 or the local and remote addresses of a Linux IPX socket file
1978 in the form <net>:[<node>:]<port>, followed in parentheses
1979 by the transmit and receive queue sizes, and the connection
1980 state;
1981 or ``dgram'' or ``stream'' for the type UnixWare 7.1.1 and
1983 above in-kernel UNIX domain sockets, followed by a colon
1984 (':') and the local path name when available, followed by
1985 ``->'' and the remote path name or kernel socket address in
1986 hexadecimal when available;
1987 or the association value, association index, endpoint value,
1989 local address, local port, remote address and remote port
1990 for Linux SCTP sockets;
1991 or ``protocol: '' followed by the Linux socket's protocol
1993 attribute.
1994 For dialects that support a ``namefs'' file system, allowing one file
1996 to be attached to another with fattach(3C), lsof will add ``(FA:<ad‐
1997 dress1><direction><address2>)'' to the NAME column. <address1> and
1998 <address2> are hexadecimal vnode addresses. <direction> will be ``<-''
1999 if <address2> has been fattach'ed to this vnode whose address is <ad‐
2000 dress1>; and ``->'' if <address1>, the vnode address of this vnode, has
2001 been fattach'ed to <address2>. <address1> may be omitted if it already
2002 appears in the DEVICE column.
2003 Lsof may add two parenthetical notes to the NAME column for open So‐
2005 laris 10 files: ``(?)'' if lsof considers the path name of questionable
2006 accuracy; and ``(deleted)'' if the -X option has been specified and
2007 lsof detects the open file's path name has been deleted. Consult the
2008 lsof FAQ (The FAQ section gives its location.) for more information on
2009 these NAME column additions.
2010
2012 Lsof can't adequately report the wide variety of UNIX dialect file
2013 locks in a single character. What it reports in a single character is
2014 a compromise between the information it finds in the kernel and the
2015 limitations of the reporting format.
2016 Moreover, when a process holds several byte level locks on a file, lsof
2018 only reports the status of the first lock it encounters. If it is a
2019 byte level lock, then the lock character will be reported in lower case
2020 - i.e., `r', `w', or `x' - rather than the upper case equivalent re‐
2021 ported for a full file lock.
2022 Generally lsof can only report on locks held by local processes on lo‐
2024 cal files. When a local process sets a lock on a remotely mounted
2025 (e.g., NFS) file, the remote server host usually records the lock
2026 state. One exception is Solaris - at some patch levels of 2.3, and in
2027 all versions above 2.4, the Solaris kernel records information on re‐
2028 mote locks in local structures.
2029 Lsof has trouble reporting locks for some UNIX dialects. Consult the
2031 BUGS section of this manual page or the lsof FAQ (The FAQ section gives
2032 its location.) for more information.
2033
2035 When the -F option is specified, lsof produces output that is suitable
2036 for processing by another program - e.g, an awk or Perl script, or a C
2037 program.
2038 Each unit of information is output in a field that is identified with a
2040 leading character and terminated by a NL (012) (or a NUL (000) if the 0
2041 (zero) field identifier character is specified.) The data of the field
2042 follows immediately after the field identification character and ex‐
2043 tends to the field terminator.
2044 It is possible to think of field output as process and file sets. A
2046 process set begins with a field whose identifier is `p' (for process
2047 IDentifier (PID)). It extends to the beginning of the next PID field
2048 or the beginning of the first file set of the process, whichever comes
2049 first. Included in the process set are fields that identify the com‐
2050 mand, the process group IDentification (PGID) number, the task (thread)
2051 ID (TID), and the user ID (UID) number or login name.
2052 A file set begins with a field whose identifier is `f' (for file de‐
2054 scriptor). It is followed by lines that describe the file's access
2055 mode, lock state, type, device, size, offset, inode, protocol, name and
2056 stream module names. It extends to the beginning of the next file or
2057 process set, whichever comes first.
2058 When the NUL (000) field terminator has been selected with the 0 (zero)
2060 field identifier character, lsof ends each process and file set with a
2061 NL (012) character.
2062 Lsof always produces one field, the PID (`p') field. In repeat mode,
2064 the marker (`m') is also produced. All other fields may be declared
2065 optionally in the field identifier character list that follows the -F
2066 option. When a field selection character identifies an item lsof does
2067 not normally list - e.g., PPID, selected with -R - specification of the
2068 field character - e.g., ``-FR'' - also selects the listing of the item.
2069 Lsof version from 4.88 to 4.93.2 always produced one more field, the
2071 file descriptor (`f') field. However, lsof in this version doesn't pro‐
2072 duce it. This change is for supporting the use case that a user needs
2073 only the PID field, and doesn't need the file descriptor field. Specify
2074 `f' explicitly if you need the field.
2075 It is entirely possible to select a set of fields that cannot easily be
2077 parsed - e.g., if the field descriptor field is not selected, it may be
2078 difficult to identify file sets. To help you avoid this difficulty,
2079 lsof supports the -F option; it selects the output of all fields with
2080 NL terminators (the -F0 option pair selects the output of all fields
2081 with NUL terminators). For compatibility reasons neither -F nor -F0
2082 select the raw device field.
2083 These are the fields that lsof will produce. The single character
2085 listed first is the field identifier.
2086 a file access mode
2088 c process command name (all characters from proc or
2089 user structure)
2090 C file structure share count
2091 d file's device character code
2092 D file's major/minor device number (0x<hexadecimal>)
2093 f file descriptor
2094 F file structure address (0x<hexadecimal>)
2095 G file flaGs (0x<hexadecimal>; names if +fg follows)
2096 g process group ID
2097 i file's inode number
2098 K tasK ID
2099 k link count
2100 l file's lock status
2101 L process login name
2102 m marker between repeated output (always selected in repeat mode)
2103 M the task comMand name
2104 n file name, comment, Internet address
2105 N node identifier (ox<hexadecimal>
2106 o file's offset (0t<decimal> or 0x<hexadecimal>, see -o o)
2107 p process ID (always selected)
2108 P protocol name
2109 r raw device number (0x<hexadecimal>)
2110 R parent process ID
2111 s file's size (decimal)
2112 S file's stream identification
2113 t file's type
2114 T TCP/TPI information, identified by prefixes (the
2115 `=' is part of the prefix):
2116 QR=<read queue size>
2117 QS=<send queue size>
2118 SO=<socket options and values> (not all dialects)
2119 SS=<socket states> (not all dialects)
2120 ST=<connection state>
2121 TF=<TCP flags and values> (not all dialects)
2122 WR=<window read size> (not all dialects)
2123 WW=<window write size> (not all dialects)
2124 (TCP/TPI information isn't reported for all supported
2125 UNIX dialects. The -h or -? help output for the
2126 -T option will show what TCP/TPI reporting can be
2127 requested.)
2128 u process user ID
2129 z Solaris 10 and higher zone name
2130 Z SELinux security context (inhibited when SELinux is disabled)
2131 0 use NUL field terminator character in place of NL
2132 1-9 dialect-specific field identifiers (The output
2133 of -F? identifies the information to be found
2134 in dialect-specific fields.)
2135 You can get on-line help information on these characters and their de‐
2137 scriptions by specifying the -F? option pair. (Escape the `?' charac‐
2138 ter as your shell requires.) Additional information on field content
2139 can be found in the OUTPUT section.
2140 As an example, ``-F pcfn'' will select the process ID (`p'), command
2142 name (`c'), file descriptor (`f') and file name (`n') fields with an NL
2143 field terminator character; ``-F pcfn0'' selects the same output with a
2144 NUL (000) field terminator character.
2145 Lsof doesn't produce all fields for every process or file set, only
2147 those that are available. Some fields are mutually exclusive: file de‐
2148 vice characters and file major/minor device numbers; file inode number
2149 and protocol name; file name and stream identification; file size and
2150 offset. One or the other member of these mutually exclusive sets will
2151 appear in field output, but not both.
2152 Normally lsof ends each field with a NL (012) character. The 0 (zero)
2154 field identifier character may be specified to change the field termi‐
2155 nator character to a NUL (000). A NUL terminator may be easier to
2156 process with xargs [4m(1), for example, or with programs whose quoting
2157 mechanisms may not easily cope with the range of characters in the
2158 field output. When the NUL field terminator is in use, lsof ends each
2159 process and file set with a NL (012).
2160 Three aids to producing programs that can process lsof field output are
2162 included in the lsof distribution. The first is a C header file,
2163 lsof_fields.h, that contains symbols for the field identification char‐
2164 acters, indexes for storing them in a table, and explanation strings
2165 that may be compiled into programs. Lsof uses this header file.
2166 The second aid is a set of sample scripts that process field output,
2168 written in awk, Perl 4, and Perl 5. They're located in the scripts
2169 subdirectory of the lsof distribution.
2170 The third aid is the C library used for the lsof test suite. The test
2172 suite is written in C and uses field output to validate the correct op‐
2173 eration of lsof. The library can be found in the tests/LTlib.c file of
2174 the lsof distribution. The library uses the first aid, the
2175 lsof_fields.h header file.
2176
2178 Lsof can be blocked by some kernel functions that it uses - lstat(2),
2179 readlink(2), and stat(2). These functions are stalled in the kernel,
2180 for example, when the hosts where mounted NFS file systems reside be‐
2181 come inaccessible.
2182 Lsof attempts to break these blocks with timers and child processes,
2184 but the techniques are not wholly reliable. When lsof does manage to
2185 break a block, it will report the break with an error message. The
2186 messages may be suppressed with the -t and -w options.
2187 The default timeout value may be displayed with the -h or -? option,
2189 and it may be changed with the -S [t] option. The minimum for t is two
2190 seconds, but you should avoid small values, since slow system respon‐
2191 siveness can cause short timeouts to expire unexpectedly and perhaps
2192 stop lsof before it can produce any output.
2193 When lsof has to break a block during its access of mounted file system
2195 information, it normally continues, although with less information
2196 available to display about open files.
2197 Lsof can also be directed to avoid the protection of timers and child
2199 processes when using the kernel functions that might block by specify‐
2200 ing the -O option. While this will allow lsof to start up with less
2201 overhead, it exposes lsof completely to the kernel situations that
2202 might block it. Use this option cautiously.
2203
2205 You can use the -b option to tell lsof to avoid using kernel functions
2206 that would block. Some cautions apply.
2207 First, using this option usually requires that your system supply al‐
2209 ternate device numbers in place of the device numbers that lsof would
2210 normally obtain with the lstat(2) and stat(2) kernel functions. See
2211 the ALTERNATE DEVICE NUMBERS section for more information on alternate
2212 device numbers.
2213 Second, you can't specify names for lsof to locate unless they're file
2215 system names. This is because lsof needs to know the device and inode
2216 numbers of files listed with names in the lsof options, and the -b op‐
2217 tion prevents lsof from obtaining them. Moreover, since lsof only has
2218 device numbers for the file systems that have alternates, its ability
2219 to locate files on file systems depends completely on the availability
2220 and accuracy of the alternates. If no alternates are available, or if
2221 they're incorrect, lsof won't be able to locate files on the named file
2222 systems.
2223 Third, if the names of your file system directories that lsof obtains
2225 from your system's mount table are symbolic links, lsof won't be able
2226 to resolve the links. This is because the -b option causes lsof to
2227 avoid the kernel readlink(2) function it uses to resolve symbolic
2228 links.
2229 Finally, using the -b option causes lsof to issue warning messages when
2231 it needs to use the kernel functions that the -b option directs it to
2232 avoid. You can suppress these messages by specifying the -w option,
2233 but if you do, you won't see the alternate device numbers reported in
2234 the warning messages.
2235
2237 On some dialects, when lsof has to break a block because it can't get
2238 information about a mounted file system via the lstat(2) and stat(2)
2239 kernel functions, or because you specified the -b option, lsof can ob‐
2240 tain some of the information it needs - the device number and possibly
2241 the file system type - from the system mount table. When that is pos‐
2242 sible, lsof will report the device number it obtained. (You can sup‐
2243 press the report by specifying the -w option.)
2244 You can assist this process if your mount table is supported with an
2246 /etc/mtab or /etc/mnttab file that contains an options field by adding
2247 a ``dev=xxxx'' field for mount points that do not have one in their op‐
2248 tions strings. Note: you must be able to edit the file - i.e., some
2249 mount tables like recent Solaris /etc/mnttab or Linux /proc/mounts are
2250 read-only and can't be modified.
2251 You may also be able to supply device numbers using the +m and +m m op‐
2253 tions, provided they are supported by your dialect. Check the output
2254 of lsof's -h or -? options to see if the +m and +m m options are
2255 available.
2256 The ``xxxx'' portion of the field is the hexadecimal value of the file
2258 system's device number. (Consult the st_dev field of the output of the
2259 lstat(2) and stat(2) functions for the appropriate values for your file
2260 systems.) Here's an example from a Sun Solaris 2.6 /etc/mnttab for a
2261 file system remotely mounted via NFS:
2262 nfs ignore,noquota,dev=2a40001
2264 There's an advantage to having ``dev=xxxx'' entries in your mount table
2266 file, especially for file systems that are mounted from remote NFS
2267 servers. When a remote server crashes and you want to identify its
2268 users by running lsof on one of its clients, lsof probably won't be
2269 able to get output from the lstat(2) and stat(2) functions for the file
2270 system. If it can obtain the file system's device number from the
2271 mount table, it will be able to display the files open on the crashed
2272 NFS server.
2273 Some dialects that do not use an ASCII /etc/mtab or /etc/mnttab file
2275 for the mount table may still provide an alternative device number in
2276 their internal mount tables. This includes AIX, Apple Darwin, FreeBSD,
2277 NetBSD, OpenBSD, and Tru64 UNIX. Lsof knows how to obtain the alterna‐
2278 tive device number for these dialects and uses it when its attempt to
2279 lstat(2) or stat(2) the file system is blocked.
2280 If you're not sure your dialect supplies alternate device numbers for
2282 file systems from its mount table, use this lsof incantation to see if
2283 it reports any alternate device numbers:
2284 lsof -b
2286 Look for standard error file warning messages that begin ``assuming
2288 "dev=xxxx" from ...''.
2289
2291 Lsof is able to examine the kernel's name cache or use other kernel fa‐
2292 cilities (e.g., the ADVFS 4.x tag_to_path() function under Tru64 UNIX)
2293 on some dialects for most file system types, excluding AFS, and extract
2294 recently used path name components from it. (AFS file system path
2295 lookups don't use the kernel's name cache; some Solaris VxFS file sys‐
2296 tem operations apparently don't use it, either.)
2297 Lsof reports the complete paths it finds in the NAME column. If lsof
2299 can't report all components in a path, it reports in the NAME column
2300 the file system name, followed by a space, two `-' characters, another
2301 space, and the name components it has located, separated by the `/'
2302 character.
2303 When lsof is run in repeat mode - i.e., with the -r option specified -
2305 the extent to which it can report path name components for the same
2306 file may vary from cycle to cycle. That's because other running pro‐
2307 cesses can cause the kernel to remove entries from its name cache and
2308 replace them with others.
2309 Lsof's use of the kernel name cache to identify the paths of files can
2311 lead it to report incorrect components under some circumstances. This
2312 can happen when the kernel name cache uses device and node number as a
2313 key (e.g., SCO OpenServer) and a key on a rapidly changing file system
2314 is reused. If the UNIX dialect's kernel doesn't purge the name cache
2315 entry for a file when it is unlinked, lsof may find a reference to the
2316 wrong entry in the cache. The lsof FAQ (The FAQ section gives its lo‐
2317 cation.) has more information on this situation.
2318 Lsof can report path name components for these dialects:
2320 FreeBSD
2322 HP-UX
2323 Linux
2324 NetBSD
2325 NEXTSTEP
2326 OpenBSD
2327 OPENSTEP
2328 SCO OpenServer
2329 SCO|Caldera UnixWare
2330 Solaris
2331 Tru64 UNIX
2332 Lsof can't report path name components for these dialects:
2334 AIX
2336 If you want to know why lsof can't report path name components for some
2338 dialects, see the lsof FAQ (The FAQ section gives its location.)
2339
2341 Examining all members of the /dev (or /devices) node tree with stat(2)
2342 functions can be time consuming. What's more, the information that
2343 lsof needs - device number, inode number, and path - rarely changes.
2344 Consequently, lsof normally maintains an ASCII text file of cached /dev
2346 (or /devices) information (exception: the /proc-based Linux lsof where
2347 it's not needed.) The local system administrator who builds lsof can
2348 control the way the device cache file path is formed, selecting from
2349 these options:
2350 Path from the -D option;
2352 Path from an environment variable;
2353 System-wide path;
2354 Personal path (the default);
2355 Personal path, modified by an environment variable.
2356 Consult the output of the -h, -D? , or -? help options for the current
2358 state of device cache support. The help output lists the default
2359 read-mode device cache file path that is in effect for the current in‐
2360 vocation of lsof. The -D? option output lists the read-only and write
2361 device cache file paths, the names of any applicable environment vari‐
2362 ables, and the personal device cache path format.
2363 Lsof can detect that the current device cache file has been acciden‐
2365 tally or maliciously modified by integrity checks, including the compu‐
2366 tation and verification of a sixteen bit Cyclic Redundancy Check (CRC)
2367 sum on the file's contents. When lsof senses something wrong with the
2368 file, it issues a warning and attempts to remove the current cache file
2369 and create a new copy, but only to a path that the process can legiti‐
2370 mately write.
2371 The path from which a lsof process may attempt to read a device cache
2373 file may not be the same as the path to which it can legitimately
2374 write. Thus when lsof senses that it needs to update the device cache
2375 file, it may choose a different path for writing it from the path from
2376 which it read an incorrect or outdated version.
2377 If available, the -Dr option will inhibit the writing of a new device
2379 cache file. (It's always available when specified without a path name
2380 argument.)
2381 When a new device is added to the system, the device cache file may
2383 need to be recreated. Since lsof compares the mtime of the device
2384 cache file with the mtime and ctime of the /dev (or /devices) direc‐
2385 tory, it usually detects that a new device has been added; in that case
2386 lsof issues a warning message and attempts to rebuild the device cache
2387 file.
2388 Whenever lsof writes a device cache file, it sets its ownership to the
2390 real UID of the executing process, and its permission modes to 0600,
2391 this restricting its reading and writing to the file's owner.
2392
2394 Two permissions of the lsof executable affect its ability to access de‐
2395 vice cache files. The permissions are set by the local system adminis‐
2396 trator when lsof is installed.
2397 The first and rarer permission is setuid-root. It comes into effect
2399 when lsof is executed; its effective UID is then root, while its real
2400 (i.e., that of the logged-on user) UID is not. The lsof distribution
2401 recommends that versions for these dialects run setuid-root.
2402 HP-UX 11.11 and 11.23
2404 Linux
2405 The second and more common permission is setgid. It comes into effect
2407 when the effective group IDentification number (GID) of the lsof
2408 process is set to one that can access kernel memory devices - e.g.,
2409 ``kmem'', ``sys'', or ``system''.
2410 An lsof process that has setgid permission usually surrenders the per‐
2412 mission after it has accessed the kernel memory devices. When it does
2413 that, lsof can allow more liberal device cache path formations. The
2414 lsof distribution recommends that versions for these dialects run set‐
2415 gid and be allowed to surrender setgid permission.
2416 AIX 5.[12] and 5.3-ML1
2418 Apple Darwin 7.x Power Macintosh systems
2419 FreeBSD 4.x, 4.1x, 5.x and [6789].x for x86-based systems
2420 FreeBSD 5.x, [6789].x and 1[012].8for Alpha, AMD64 and Sparc64
2421 based systems
2422 HP-UX 11.00
2423 NetBSD 1.[456], 2.x and 3.x for Alpha, x86, and SPARC-based
2424 systems
2425 NEXTSTEP 3.[13] for NEXTSTEP architectures
2426 OpenBSD 2.[89] and 3.[0-9] for x86-based systems
2427 OPENSTEP 4.x
2428 SCO OpenServer Release 5.0.6 for x86-based systems
2429 SCO|Caldera UnixWare 7.1.4 for x86-based systems
2430 Solaris 2.6, 8, 9 and 10
2431 Tru64 UNIX 5.1
2432 (Note: lsof for AIX 5L and above needs setuid-root permission if its -X
2434 option is used.)
2435 Lsof for these dialects does not support a device cache, so the permis‐
2437 sions given to the executable don't apply to the device cache file.
2438 Linux
2440
2442 The -D option provides limited means for specifying the device cache
2443 file path. Its ? function will report the read-only and write device
2444 cache file paths that lsof will use.
2445 When the -D b, r, and u functions are available, you can use them to
2447 request that the cache file be built in a specific location (b[path]);
2448 read but not rebuilt (r[path]); or read and rebuilt (u[path]). The b,
2449 r, and u functions are restricted under some conditions. They are re‐
2450 stricted when the lsof process is setuid-root. The path specified with
2451 the r function is always read-only, even when it is available.
2452 The b, r, and u functions are also restricted when the lsof process
2454 runs setgid and lsof doesn't surrender the setgid permission. (See the
2455 LSOF PERMISSIONS THAT AFFECT DEVICE CACHE FILE ACCESS section for a
2456 list of implementations that normally don't surrender their setgid per‐
2457 mission.)
2458 A further -D function, i (for ignore), is always available.
2460 When available, the b function tells lsof to read device information
2462 from the kernel with the stat(2) function and build a device cache file
2463 at the indicated path.
2464 When available, the r function tells lsof to read the device cache
2466 file, but not update it. When a path argument accompanies -Dr, it
2467 names the device cache file path. The r function is always available
2468 when it is specified without a path name argument. If lsof is not run‐
2469 ning setuid-root and surrenders its setgid permission, a path name ar‐
2470 gument may accompany the r function.
2471 When available, the u function tells lsof to attempt to read and use
2473 the device cache file. If it can't read the file, or if it finds the
2474 contents of the file incorrect or outdated, it will read information
2475 from the kernel, and attempt to write an updated version of the device
2476 cache file, but only to a path it considers legitimate for the lsof
2477 process effective and real UIDs.
2478
2480 Lsof's second choice for the device cache file is the contents of the
2481 LSOFDEVCACHE environment variable. It avoids this choice if the lsof
2482 process is setuid-root, or the real UID of the process is root.
2483 A further restriction applies to a device cache file path taken from
2485 the LSOFDEVCACHE environment variable: lsof will not write a device
2486 cache file to the path if the lsof process doesn't surrender its setgid
2487 permission. (See the LSOF PERMISSIONS THAT AFFECT DEVICE CACHE FILE
2488 ACCESS section for information on implementations that don't surrender
2489 their setgid permission.)
2490 The local system administrator can disable the use of the LSOFDEVCACHE
2492 environment variable or change its name when building lsof. Consult
2493 the output of -D? for the environment variable's name.
2494
2496 The local system administrator may choose to have a system-wide device
2497 cache file when building lsof. That file will generally be constructed
2498 by a special system administration procedure when the system is booted
2499 or when the contents of /dev or /devices) changes. If defined, it is
2500 lsof's third device cache file path choice.
2501 You can tell that a system-wide device cache file is in effect for your
2503 local installation by examining the lsof help option output - i.e., the
2504 output from the -h or -? option.
2505 Lsof will never write to the system-wide device cache file path by de‐
2507 fault. It must be explicitly named with a -D function in a root-owned
2508 procedure. Once the file has been written, the procedure must change
2509 its permission modes to 0644 (owner-read and owner-write, group-read,
2510 and other-read).
2511
2513 The default device cache file path of the lsof distribution is one
2514 recorded in the home directory of the real UID that executes lsof.
2515 Added to the home directory is a second path component of the form
2516 .lsof_hostname.
2517 This is lsof's fourth device cache file path choice, and is usually the
2519 default. If a system-wide device cache file path was defined when lsof
2520 was built, this fourth choice will be applied when lsof can't find the
2521 system-wide device cache file. This is the only time lsof uses two
2522 paths when reading the device cache file.
2523 The hostname part of the second component is the base name of the exe‐
2525 cuting host, as returned by gethostname(2). The base name is defined
2526 to be the characters preceding the first `.' in the gethostname(2)
2527 output, or all the gethostname(2) output if it contains no `.'.
2528 The device cache file belongs to the user ID and is readable and
2530 writable by the user ID alone - i.e., its modes are 0600. Each dis‐
2531 tinct real user ID on a given host that executes lsof has a distinct
2532 device cache file. The hostname part of the path distinguishes device
2533 cache files in an NFS-mounted home directory into which device cache
2534 files are written from several different hosts.
2535 The personal device cache file path formed by this method represents a
2537 device cache file that lsof will attempt to read, and will attempt to
2538 write should it not exist or should its contents be incorrect or out‐
2539 dated.
2540 The -Dr option without a path name argument will inhibit the writing of
2542 a new device cache file.
2543 The -D? option will list the format specification for constructing the
2545 personal device cache file. The conversions used in the format speci‐
2546 fication are described in the 00DCACHE file of the lsof distribution.
2547
2549 If this option is defined by the local system administrator when lsof
2550 is built, the LSOFPERSDCPATH environment variable contents may be used
2551 to add a component of the personal device cache file path.
2552 The LSOFPERSDCPATH variable contents are inserted in the path at the
2554 place marked by the local system administrator with the ``%p'' conver‐
2555 sion in the HASPERSDC format specification of the dialect's machine.h
2556 header file. (It's placed right after the home directory in the de‐
2557 fault lsof distribution.)
2558 Thus, for example, if LSOFPERSDCPATH contains ``LSOF'', the home direc‐
2560 tory is ``/Homes/abe'', the host name is ``lsof.itap.purdue.edu'', and
2561 the HASPERSDC format is the default (``%h/%p.lsof_%L''), the modified
2562 personal device cache file path is:
2563 /Homes/abe/LSOF/.lsof_vic
2565 The LSOFPERSDCPATH environment variable is ignored when the lsof
2567 process is setuid-root or when the real UID of the process is root.
2568 Lsof will not write to a modified personal device cache file path if
2570 the lsof process doesn't surrender setgid permission. (See the LSOF
2571 PERMISSIONS THAT AFFECT DEVICE CACHE FILE ACCESS section for a list of
2572 implementations that normally don't surrender their setgid permission.)
2573 If, for example, you want to create a sub-directory of personal device
2575 cache file paths by using the LSOFPERSDCPATH environment variable to
2576 name it, and lsof doesn't surrender its setgid permission, you will
2577 have to allow lsof to create device cache files at the standard per‐
2578 sonal path and move them to your subdirectory with shell commands.
2579 The local system administrator may: disable this option when lsof is
2581 built; change the name of the environment variable from LSOFPERSDCPATH
2582 to something else; change the HASPERSDC format to include the personal
2583 path component in another place; or exclude the personal path component
2584 entirely. Consult the output of the -D? option for the environment
2585 variable's name and the HASPERSDC format specification.
2586
2588 Errors are identified with messages on the standard error file.
2589 Lsof returns a one (1) if any error was detected, including the failure
2591 to locate command names, file names, Internet addresses or files, login
2592 names, NFS files, PIDs, PGIDs, or UIDs it was asked to list. If the -V
2593 option is specified, lsof will indicate the search items it failed to
2594 list.
2595 It returns a zero (0) if no errors were detected and if it was able to
2597 list some information about all the specified search arguments.
2598 When lsof cannot open access to /dev (or /devices) or one of its subdi‐
2600 rectories, or get information on a file in them with stat(2), it issues
2601 a warning message and continues. That lsof will issue warning messages
2602 about inaccessible files in /dev (or /devices) is indicated in its help
2603 output - requested with the -h or >B -? options - with the message:
2604 Inaccessible /dev warnings are enabled.
2606 The warning message may be suppressed with the -w option. It may also
2608 have been suppressed by the system administrator when lsof was compiled
2609 by the setting of the WARNDEVACCESS definition. In this case, the out‐
2610 put from the help options will include the message:
2611 Inaccessible /dev warnings are disabled.
2613 Inaccessible device warning messages usually disappear after lsof has
2615 created a working device cache file.
2616
2618 For a more extensive set of examples, documented more fully, see the
2619 00QUICKSTART file of the lsof distribution.
2620 To list all open files, use:
2622 lsof
2624 To list all open Internet, x.25 (HP-UX), and UNIX domain files, use:
2626 lsof -i -U
2628 To list all open IPv4 network files in use by the process whose PID is
2630 1234, use:
2631 lsof -i 4 -a -p 1234
2633 Presuming the UNIX dialect supports IPv6, to list only open IPv6 net‐
2635 work files, use:
2636 lsof -i 6
2638 To list all files using any protocol on ports 513, 514, or 515 of host
2640 wonderland.cc.purdue.edu, use:
2641 lsof -i @wonderland.cc.purdue.edu:513-515
2643 To list all files using any protocol on any port of mace.cc.purdue.edu
2645 (cc.purdue.edu is the default domain), use:
2646 lsof -i @mace
2648 To list all open files for login name ``abe'', or user ID 1234, or
2650 process 456, or process 123, or process 789, use:
2651 lsof -p 456,123,789 -u 1234,abe
2653 To list all open files on device /dev/hd4, use:
2655 lsof /dev/hd4
2657 To find the process that has /u/abe/foo open, use:
2659 lsof /u/abe/foo
2661 To send a SIGHUP to the processes that have /u/abe/bar open, use:
2663 kill -HUP `lsof -t /u/abe/bar`
2665 To find any open file, including an open UNIX domain socket file, with
2667 the name /dev/log, use:
2668 lsof /dev/log
2670 To find processes with open files on the NFS file system named
2672 /nfs/mount/point whose server is inaccessible, and presuming your mount
2673 table supplies the device number for /nfs/mount/point, use:
2674 lsof -b /nfs/mount/point
2676 To do the preceding search with warning messages suppressed, use:
2678 lsof -bw /nfs/mount/point
2680 To ignore the device cache file, use:
2682 lsof -Di
2684 To obtain PID and command name field output for each process, file de‐
2686 scriptor, file device number, and file inode number for each file of
2687 each process, use:
2688 lsof -FpcfDi
2690 To list the files at descriptors 1 and 3 of every process running the
2692 lsof command for login ID ``abe'' every 10 seconds, use:
2693 lsof -c lsof -a -d 1 -d 3 -u abe -r10
2695 To list the current working directory of processes running a command
2697 that is exactly four characters long and has an 'o' or 'O' in character
2698 three, use this regular expression form of the -c c option:
2699 lsof -c /^..o.$/i -a -d cwd
2701 To find an IP version 4 socket file by its associated numeric dot-form
2703 address, use:
2704 lsof -i@128.210.15.17
2706 To find an IP version 6 socket file (when the UNIX dialect supports
2708 IPv6) by its associated numeric colon-form address, use:
2709 lsof -i@[0:1:2:3:4:5:6:7]
2711 To find an IP version 6 socket file (when the UNIX dialect supports
2713 IPv6) by an associated numeric colon-form address that has a run of ze‐
2714 roes in it - e.g., the loop-back address - use:
2715 lsof -i@[::1]
2717 To obtain a repeat mode marker line that contains the current time,
2719 use:
2720 lsof -rm====%T====
2722 To add spaces to the previous marker line, use:
2724 lsof -r "m==== %T ===="
2726
2728 Since lsof reads kernel memory in its search for open files, rapid
2729 changes in kernel memory may produce unpredictable results.
2730 When a file has multiple record locks, the lock status character (fol‐
2732 lowing the file descriptor) is derived from a test of the first lock
2733 structure, not from any combination of the individual record locks that
2734 might be described by multiple lock structures.
2735 Lsof can't search for files with restrictive access permissions by name
2737 unless it is installed with root set-UID permission. Otherwise it is
2738 limited to searching for files to which its user or its set-GID group
2739 (if any) has access permission.
2740 The display of the destination address of a raw socket (e.g., for ping)
2742 depends on the UNIX operating system. Some dialects store the destina‐
2743 tion address in the raw socket's protocol control block, some do not.
2744 Lsof can't always represent Solaris device numbers in the same way that
2746 ls(1) does. For example, the major and minor device numbers that the
2747 lstat(2) and stat(2) functions report for the directory on which CD-ROM
2748 files are mounted (typically /cdrom) are not the same as the ones that
2749 it reports for the device on which CD-ROM files are mounted (typically
2750 /dev/sr0). (Lsof reports the directory numbers.)
2751 The support for /proc file systems is available only for BSD and Tru64
2753 UNIX dialects, Linux, and dialects derived from SYSV R4 - e.g., Free‐
2754 BSD, NetBSD, OpenBSD, Solaris, UnixWare.
2755 Some /proc file items - device number, inode number, and file size -
2757 are unavailable in some dialects. Searching for files in a /proc file
2758 system may require that the full path name be specified.
2759 No text (txt) file descriptors are displayed for Linux processes. All
2761 entries for files other than the current working directory, the root
2762 directory, and numerical file descriptors are labeled mem descriptors.
2763 Lsof can't search for Tru64 UNIX named pipes by name, because their
2765 kernel implementation of lstat(2) returns an improper device number for
2766 a named pipe.
2767 Lsof can't report fully or correctly on HP-UX 9.01, 10.20, and 11.00
2769 locks because of insufficient access to kernel data or errors in the
2770 kernel data. See the lsof FAQ (The FAQ section gives its location.)
2771 for details.
2772 The AIX SMT file type is a fabrication. It's made up for file struc‐
2774 tures whose type (15) isn't defined in the AIX /usr/include/sys/file.h
2775 header file. One way to create such file structures is to run X
2776 clients with the DISPLAY variable set to ``:0.0''.
2777 The +|-f[cfn] option is not supported under /proc-based Linux lsof, be‐
2779 cause it doesn't read kernel structures from kernel memory.
2780
2782 Lsof may access these environment variables.
2783 LANG defines a language locale. See setlocale(3) for the
2785 names of other variables that can be used in place of
2786 LANG - e.g., LC_ALL, LC_TYPE, etc.
2787 LSOFDEVCACHE defines the path to a device cache file. See the DE‐
2789 VICE CACHE PATH FROM AN ENVIRONMENT VARIABLE section
2790 for more information.
2791 LSOFPERSDCPATH defines the middle component of a modified personal
2793 device cache file path. See the MODIFIED PERSONAL
2794 DEVICE CACHE PATH section for more information.
2795
2797 Frequently-asked questions and their answers (an FAQ) are available in
2798 the 00FAQ file of the lsof distribution.
2799 That latest version of the file is found at:
2801 https://github.com/lsof-org/lsof/blob/master/00FAQ
2803
2805 /dev/kmem kernel virtual memory device
2806 /dev/mem physical memory device
2808 /dev/swap system paging device
2810 .lsof_hostname lsof's device cache file (The suffix, hostname, is
2812 the first component of the host's name returned by
2813 gethostname(2).)
2814
2816 Lsof was written by Victor A.Abell <abe@purdue.edu> of Purdue Univer‐
2817 sity. Since version 4.93.0, the lsof-org team at GitHub maintains
2818 lsof. Many others have contributed to lsof. They're listed in the
2819 00CREDITS file of the lsof distribution.
2820
2822 The latest distribution of lsof is available at
2823 https://github.com/lsof-org/lsof/releases
2825
2827 Not all the following manual pages may exist in every UNIX dialect to
2828 which lsof has been ported.
2829 access(2), awk(1), crash(1), fattach(3C), ff(1), fstat(8), fuser(1),
2831 gethostname(2), isprint(3), kill(1), localtime(3), lstat(2), mod‐
2832 load(8), mount(8), netstat(1), ofiles(8L), open(2), perl(1), ps(1),
2833 readlink(2), setlocale(3), stat(2), strftime(3), time(2), uname(1).
2834 Revision-4.94.0 LSOF(1)