Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In my experience, files that have the file descriptor of txt in lsof output are the executable file itself and shared objects. The lsof man page says that it means "program text (code and data)".

While debugging a problem, I found a large number of data files (specifically, ElasticSearch database index files) that lsof reported as txt. These are definitely not executable files. The process was ElasticSearch itself, which is a java process, if that helps point someone in the right direction.

I want to understand how this process is opening and using these files that gets it to be reported in this way. I'm trying to understand some memory utilization, and I suspect that these open files are related to some metrics I'm seeing in some way.

The system is Solaris 10 x86.

share|improve this question
To track down whatever problem you're pursuing I'm not sure I would use lsof on Solaris. That command is something of a hack on Solaris which is why it isn't included in the OS by default. The true alternatives on Solaris would be pfiles command and DTrace. Using the latter you can monitor for example file operations in real time. – unixhacker2010 Nov 2 '13 at 11:03
Nice info on pfiles; thanks. – wfaulk Nov 5 '13 at 17:08
up vote 1 down vote accepted

On Solaris, everything that is mapped into the memory space of the process will be listed by lsof as txt, regardless of being the started executable, or an executable shared object mapped by, or any data file mapped directly by the application.

On Linux, only the started executable will be listed as txt, everything else mapped into the memory space will be shown as mem (both executable shared objects and data files).

share|improve this answer
Interesting. The lsof documentation says that mmap()ed files will be reported as mem, but a quick test program shows me that that's not the case. – wfaulk Oct 23 '13 at 22:58
Specifically, mmap()ed files that still have a file descriptor open are referenced by that file descriptor and mmap()ed files whose file descriptors have been closed are reported as txt. – wfaulk Oct 23 '13 at 23:04

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.