The tag has no usage guidance.

learn more… | top users | synonyms

0
votes
1answer
15 views

Is there a way to know the duration for which the connection is open using lsof?

If not possible with lsof what other way to find the time for which the connection is open on a machine. Please do let me know if you need any other information.
0
votes
1answer
26 views

find files which are not currently in use

I'm trying to archive some older files, but don't want to touch all the files which are currently in use. What's the best way to ask find to exclude "in use" files? Right now I'm working on this ...
2
votes
1answer
189 views

lsof doesn't show the established TCP connection

On my system, if I run the netstat for a port, it returns: $ netstat -nat | grep "60964" tcp 0 0 192.0.0.1:60964 0.0.0.0:* LISTEN tcp 59 0 ...
2
votes
1answer
49 views

Is it possible to deterministically trace how port 80 is forwarded and where the configuration is on a given system?

Is there a way to determine or trace how a port forwarding configuration is set up on a system running Ubuntu 14.04 LTS, on which there is a NodeJS service running and somehow accepting connections ...
0
votes
1answer
105 views

Safe to kill a process called *:etlservicemgr (LISTEN)?

I am trying to serve locally to port 9001 but I get an listen EADDRINUSE error. When I look at the port with lsof -i :9001 it shows the following COMMAND PID USER FD TYPE DEVICE ...
2
votes
1answer
41 views

Process has more open sockets than should be allowed by prlimit

Running debian jessie. The following is done as root to avoid any permissions issues. First I find the pid of my program, then I check its open file limit to verify that it is set at 1024. But when I ...
3
votes
2answers
159 views

lsof runs very slow in my server

All I'm running lsof in one of my Linux server to check if one file (/tmp/incoming_data.txt) in the ext3 system is opened by other programs. My server has lots of TCP connection on it. The weird ...
0
votes
0answers
25 views

How to measure file access by process over time?

I would like to take a sampling of data / file access over the course of several hours or days in order to ascertain what processes (with their accompanying files) are consuming the most drive IO in ...
-3
votes
1answer
75 views

Display only some of the lines of the lsof command [closed]

I am trying to create a bash script for displaying only certain lines of the lsof command. I have figured out that the lsof command itself lists information in the form of columns which show info ...
0
votes
1answer
85 views

Pipe lsof to grep to awk ps -ef to grep

I'm trying to get some info on a certain PID. I'm probably doing this in a manner that is way too difficult, but I'm trying to run this: lsof | grep grepstuff | awk '{ps -ef | grep $2;}' and I'm ...
2
votes
1answer
106 views

Regular and repetitive sudo alerts from several Linux hosts

I've got several hosts running CentOS 5.11 on the LAN. Lately we've been getting fairly regular sudo alerts (via email) from attempted sudo commands by non-authorized users. Been Googling in case the ...
0
votes
1answer
29 views

Detect which scripts are using old interpreters

I have a few Debian machines with some nearly-orphaned script interpreters, for example /bin/bash3 and /usr/bin/perl510. How can I detect those scripts that still have the aforementioned interpreters ...
1
vote
1answer
169 views

Incoming FTP transfer not showing in lsof when using specific FTP client

I've got a script that continuously monitors an FTP dropbox directory and processes new files when they come in. The script runs lsof on each file before it tries to process it to determine if the ...
1
vote
2answers
262 views

Can I find the list of ports being listened by a process ordered by the time of opening?

I know I can see the list of open ports using the lsof command. I am trying to view the results ordered by timestamp of listening. The process opens multiple (~6) ports and I suspect the order of ...
0
votes
1answer
191 views

lsof getting ran by root, but not by a user and using high CPU usage

My server is using high CPU usage from lsof, and it appears to be ran randomly and by the root user. I'm finding this out via Newrelic information Is it at all possible to find what is running this ...
-1
votes
1answer
95 views

Open file count keeps increasing forever

I'm experiencing issues with the number of files opened increasing over time. If I run my server for about few hours, it'll no more accept any connections. The limit was 1024. I've increased the limit ...
2
votes
1answer
187 views

How to find full process arguments and associated listening ports?

I can execute netstat -atulpn | grep java to find all Java processes with their accompanying ports, which is great, however I would like to also have the processes full execution arguments also shown. ...
2
votes
2answers
311 views

find owner and spawn process of ssh connection

There is this one server I manage which regularly (few times a minute) tries a connection to another machine on tcp port 22. (ssh) My question: how can I find the process that spawned this ...
1
vote
0answers
321 views

Apache web server maxing out due to processes stuck at D status

I have a Apache 2.2.3 web server running on a 8 core VM with 8G Ram. During a load test, the web server stopped responding and load average went up to 1000. When I run Top command, I see a large ...
2
votes
2answers
52 views

how can i see if an open filehandle is writeable or not on a linux system?

I can see with lsof that a process has an open filehandle for a particular file, but is there a way that I can see what kind of filehandle (ex: r, rw) it is?
1
vote
1answer
629 views

Near 100% disk usage, df and du show very different results, lsof not the answer

The issue is that my CentOS 5.8 machine is telling me that I am nearly out of disk space when I am pretty confident this is not the case. I've done a fair amount of researching on this issue and have ...
1
vote
1answer
197 views

txt file descriptor in lsof

In my experience, files that have the file descriptor of txt in lsof output are the executable file itself and shared objects. The lsof man page says that it means "program text (code and data)". ...
1
vote
2answers
132 views

How to map an ephemeral port to a pid?

I have a RHEL server with several apps on it and I am attempting to figure out which one of them is making calls to an external web service. I have TCP dumps that show the calls being made and through ...
1
vote
1answer
269 views

Linux: tell if file was opened with O_SYNC

Is there a way to tell if a process opened a file with the O_SYNC flag? I'm thinking lsof might be able to do this, but cannot find a way.
3
votes
1answer
77 views

How can I list all accessed files on process startup

I have a process that fails on startup due to some permission issues. I want to check what files it tries to open on startup but with lsof I can list only opened files for a running process but what ...
1
vote
1answer
257 views

Custom lsof output

The following command produced the unix domain socket opened by PID 30661 $ sudo lsof -U -a -p 30661 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME haproxy 30661 haproxy 7u ...
0
votes
1answer
111 views

Monitoring a cgi-bin executable's file usage?

One of the programs in my cgi-bin folder is misbehaving. It's a compiled binary for which I do not have the source code. I would like to set up some kind of monitor to gather a list of the files that ...
0
votes
1answer
120 views

KVM how to determine which virtual disk files are in use by VMs

I tried lsof|grep *.qcow2 and got no results back (why is that? I definitely have VMs running using that disk format). I also considered grepping qcow2 on *.xml within the config directory, but this ...
1
vote
1answer
437 views

lsof displays restored file as deleted

If I create a file named /home/martin/testfile.txt, open this file with less utility, delete /home/martin/testfile.txt file and restore it from file descriptor directory under the /proc/31148, where ...
1
vote
2answers
146 views

How to configure Apache not to keep access.log or error.log open all the time for virtualhosts?

I want to lower number of open files on my VPS. With lsof I noticed that Apache constantly keeps access.log and error.log open for each domain hosted on server. Is there a way to change this ...
1
vote
1answer
169 views

why in /proc file system have this infomation

run: lsof|grep delete can find some process open fd, but system said that it has been deleted: mingetty 2031 root txt REG 8,2 15256 49021039 /sbin/mingetty (deleted) I look in ...
1
vote
2answers
2k views

tracking down what files are causing io activity in iostat

Using iostat -Nkx 1 I can see that I am getting regular IO on a volume group. What I'm trying to do is find a way to link that IO to a file/pipe/whatever to see what process is creating this IO and ...
3
votes
2answers
3k views

How to determine which TCP/UDP ports are being opened by a given process (linux)?

I know how to do the opposite (find out what process has a given port open) using lsof or netstat, but extensive research on Google hasn't helped me solve the reverse problem. I know I could use ...
1
vote
0answers
499 views

Tracking down an elusive and slow anon_inode from lsof and Apache strace

Experiencing an intermittent issue with a LAMP application wherein Apache forks to its ServerLimit and grinds to a (near) halt. An strace on any httpd process shows numerous, slow epoll_wait calls. ...
3
votes
2answers
653 views

trace opening on a certain file

I know how to strace a certain program to see all the files it reads. I know how to see what processes are using a certain file at the moment. But is there a way to log all file opens. I want ...
1
vote
3answers
2k views

Unexplicated ssh connection from localhost through sshd to random localhost's port

I've tried to find out why I had some strange connections on my secure log file. Something like this : Apr 23 11:35:43 li192-61 sshd[11651]: Did not receive identification string from 127.0.0.1 Apr ...
1
vote
2answers
1k views

“Too many open files in system” on VPS with LSOF far from MAXFILES

Good day. Lately my VPS server (CentOS on it) started crushing with "Too many open files in system" error. I read many on the error and know that the limit is set by my hosting provider. I received a ...
3
votes
2answers
1k views

how to list files that are NOT open using find command

I want to "list" all the files that are NOT open, within a certain directory using the GNU find command. Now, I am able to list the files that are open, but can't figure out a way to do the inverse of ...
1
vote
2answers
507 views

Unknown process on port, lsof no help, nfs-kernel-server?

During a standard security sweep we found out a something was listening on a port unknown to us, 2030, and we are having trouble determining the source. # netstat -anp | grep LIST tcp 0 0 ...
1
vote
2answers
429 views

Command to monitor which processes have a given file open

I know I can use lsof path/to/file to see which processes currently have a given file open. Is there a top-like command I can use to continuously monitor which processes have a given file open?
3
votes
3answers
1k views

How can lsof report a higher number of open files than what ulimit says should be allowed?

How can lsof report more open files than what ulimit says is the limit? prod_web3(i-ca0b05aa):~$ sudo lsof | wc -l 4399 prod_web3(i-ca0b05aa):~$ ulimit -n 1024
2
votes
1answer
2k views

What's the difference between `lsof -p <pid> | wc -l` and `ls /proc/<pid>/fd | wc -l`?

Background: I'm playing around with monitoring the ulimit for running processes for a particular user. (I had occasionally seen processes that were getting started with an incorrect limit.) I asked a ...
10
votes
5answers
863 views

How to make my boss understand that a server fault is a bad thing?

I'm currently working in Tokyo for a smaller company that has just started serious online business. Recently we have been hitting the maximum open files issue on a rented VPS server causing services ...
1
vote
4answers
185 views

How to find the program responsible for a specific TCP socket (linux)

joe@server:~$ sudo lsof -i :36168 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME java 23059 activemq 15u IPv6 109382 0t0 TCP *:36168 (LISTEN) From the output above I want ...
2
votes
1answer
754 views

lsof runs REALLY slow when Chromium or Firefox is open

I have a little script that runs lsof on my laptop (Ubuntu Natty) every now and then to check for a few things. I recently noticed that it runs really slowly when I have Chromium or Firefox open. ...
0
votes
2answers
976 views

What is the meaning of this result from running 'lsof -i:8080'?

When I run the following command: lsof -i:8080 This is the result: node 32419 root 6u IPv4 122865 TCP localhost.localdomain:webcache (LISTEN) That result is different from that of ...
1
vote
1answer
569 views

lsof gives warning for some daemon

lsof | grep /var is giving me following error lsof: WARNING: can't stat() fuse.gvfs-fuse-daemon file system /home/user/.gvfs Output information may be incomplete. what can be possible reason for ...
11
votes
3answers
1k views

On Linux, how can I see how far through a file a process is?

If I have a piped command such as cat myfile | processor_application where processor_application is something reading from standard in, in chunks, to process, is it possible to see how far ...
0
votes
2answers
680 views

Clearing out deleted memory mapped files quicker?

We use Tika for PDF text content extraction for searching. I'm seeing heavy use of temporary files that seem to now run us out of file handles. We're on CentOS 5.5. For our search system, we had ...
3
votes
1answer
6k views

How can I observe what nginx is doing? (to solve: “1024 worker_connections are not enough”)

I have a very low traffic site running on nginx, with 4 workers, 1024 connections each. Every several hours I start seeing in the error log "1024 worker_connections are not enough", and my site slows ...