The tag has no usage guidance.

learn more… | top users | synonyms

0
votes
3answers
915 views

Log network traffic with process ID on Mac OS X?

I want to log all network traffic on a Mac OS X server (like tcpdump does), but including the ID of the process that is responsible. Using lsof only gives me the current connections, not the past ones....
0
votes
1answer
39 views

nrpe user cant properly execute script remotely using lsof, netstat works

I created a simple script for nagios to check a port on a remote server. Originally, I tried to use lsof. #!/bin/bash RESULT=$(lsof -i :8080 | grep LISTEN) if [ -n "$RESULT" ] then echo "$...
0
votes
2answers
68 views

How to kill/close log files that are open through lsof grep deleted?

I have a deleted a large log file from our servers. so I executed this command to validate. lsof -nP | grep '(deleted)' and this showed up. how can I permanently delete the results fo this lsof? ...
0
votes
1answer
143 views

How to combine lsof stat and ps to get more info in one line bash command

I can use lsof to get top open files stat for processes, as below: $ lsof -n|awk '{print $2}'|sort|uniq -c|sort -nr | head -n 5 17955 11945 10282 2786 5980 32152 1920 27803 1786 32107 ...
-1
votes
1answer
69 views

Why big difference between `lsof -p <pid> | wc -l` and `lsof | grep <pid> | wc -l`

I find an elasticsearch process in Ubntu 14.04 linux vm holding many file handlers, while when I use lsof to do further analysis, it just gives some confusing results as below: $ lsof -p | wc -l $ ...
2
votes
1answer
119 views

unmounted logical volume is “busy”?

I'm trying to shrink an ext4 filesystem on a CentOS 6 server. I did a lazy unmount of the filesystem while I waited for some processes to finish running. They've all finished running but I can't ...
0
votes
2answers
66 views

View what file started a process in linux

One of my servers started sending spam in heavy amounts. The server is using ISPConfig 3 and one of the web users most likely has a security breach. I have identified the user and one file somehow ...
1
vote
3answers
111 views

How can I find out which script/program/user invokes exim (and is sending spam)?

The problem A client of mine asked me to take a look at his shared-hosting webserver for the following problem, but I'm stuck at finding out what's wrong. His server is being blacklisted by a lot of ...
0
votes
0answers
51 views

Monitor outgoing web traffic sources on CentOS [duplicate]

I received a report today that a server I manage (Centos + Apache) is launching a bruteforce attack against wordpress websites: hacked-joomla/brobot The requests sent look like this: x.x.x.x - - [...
2
votes
2answers
335 views

lsof doesn't show the established TCP connection

On my system, if I run the netstat for a port, it returns: $ netstat -nat | grep "60964" tcp 0 0 192.0.0.1:60964 0.0.0.0:* LISTEN tcp 59 0 192.0.0....
0
votes
3answers
8k views

How to install LSOF in AIX

I wanna install LSOF in AIX. I've download the program from https://www14.software.ibm.com/webapp/iwm/web/reg/pick.do?source=aixbp&lang=en_US. after I unzip the tar file, I don't get readme or ...
2
votes
1answer
71 views

lsof returns “can't read vnode” error

On a Solaris 10 box, I am getting errors from lsof: can't read vnode at 0x7d900000000 can't read vnode at 0x7b But I have the same lsof binary in another similar Solaris 10 box where it doesn't ...
0
votes
1answer
30 views

Is there a way to know the duration for which the connection is open using lsof?

If not possible with lsof what other way to find the time for which the connection is open on a machine. Please do let me know if you need any other information.
0
votes
1answer
57 views

find files which are not currently in use

I'm trying to archive some older files, but don't want to touch all the files which are currently in use. What's the best way to ask find to exclude "in use" files? Right now I'm working on this ...
2
votes
1answer
58 views

Is it possible to deterministically trace how port 80 is forwarded and where the configuration is on a given system?

Is there a way to determine or trace how a port forwarding configuration is set up on a system running Ubuntu 14.04 LTS, on which there is a NodeJS service running and somehow accepting connections ...
2
votes
1answer
515 views

How to find full process arguments and associated listening ports?

I can execute netstat -atulpn | grep java to find all Java processes with their accompanying ports, which is great, however I would like to also have the processes full execution arguments also shown. ...
0
votes
1answer
641 views

Safe to kill a process called *:etlservicemgr (LISTEN)?

I am trying to serve locally to port 9001 but I get an listen EADDRINUSE error. When I look at the port with lsof -i :9001 it shows the following COMMAND PID USER FD TYPE DEVICE ...
2
votes
1answer
57 views

Process has more open sockets than should be allowed by prlimit

Running debian jessie. The following is done as root to avoid any permissions issues. First I find the pid of my program, then I check its open file limit to verify that it is set at 1024. But when I ...
5
votes
2answers
811 views

lsof runs very slow in my server

All I'm running lsof in one of my Linux server to check if one file (/tmp/incoming_data.txt) in the ext3 system is opened by other programs. My server has lots of TCP connection on it. The weird ...
-3
votes
1answer
140 views

Display only some of the lines of the lsof command [closed]

I am trying to create a bash script for displaying only certain lines of the lsof command. I have figured out that the lsof command itself lists information in the form of columns which show info ...
3
votes
2answers
2k views

how to list files that are NOT open using find command

I want to "list" all the files that are NOT open, within a certain directory using the GNU find command. Now, I am able to list the files that are open, but can't figure out a way to do the inverse of ...
0
votes
1answer
147 views

Pipe lsof to grep to awk ps -ef to grep

I'm trying to get some info on a certain PID. I'm probably doing this in a manner that is way too difficult, but I'm trying to run this: lsof | grep grepstuff | awk '{ps -ef | grep $2;}' and I'm ...
2
votes
1answer
217 views

Regular and repetitive sudo alerts from several Linux hosts

I've got several hosts running CentOS 5.11 on the LAN. Lately we've been getting fairly regular sudo alerts (via email) from attempted sudo commands by non-authorized users. Been Googling in case the ...
0
votes
1answer
32 views

Detect which scripts are using old interpreters

I have a few Debian machines with some nearly-orphaned script interpreters, for example /bin/bash3 and /usr/bin/perl510. How can I detect those scripts that still have the aforementioned interpreters ...
1
vote
1answer
284 views

Incoming FTP transfer not showing in lsof when using specific FTP client

I've got a script that continuously monitors an FTP dropbox directory and processes new files when they come in. The script runs lsof on each file before it tries to process it to determine if the ...
6
votes
4answers
18k views

Running lsof -i shows a lot of connections in CLOSE_WAIT ? Should I worry

So I am running lsof -i | wc -l periodically and it is telling me that out of 420 lines, between 240 and 255 are in CLOSE_WAIT state. How does TCP connections enter this state ? Should I be worried ...
1
vote
2answers
432 views

Can I find the list of ports being listened by a process ordered by the time of opening?

I know I can see the list of open ports using the lsof command. I am trying to view the results ordered by timestamp of listening. The process opens multiple (~6) ports and I suspect the order of ...
0
votes
1answer
309 views

lsof getting ran by root, but not by a user and using high CPU usage

My server is using high CPU usage from lsof, and it appears to be ran randomly and by the root user. I'm finding this out via Newrelic information Is it at all possible to find what is running this ...
5
votes
1answer
725 views

Why is rpc.lockd obscured from netstat/lsof output?

Prologue: On a number of machines, which happen to act as NFS clients, netstat reports two ports that are open with no PID listed for an associated daemon. Ordinarily this might be a bit concerning. ...
3
votes
3answers
2k views

How can lsof report a higher number of open files than what ulimit says should be allowed?

How can lsof report more open files than what ulimit says is the limit? prod_web3(i-ca0b05aa):~$ sudo lsof | wc -l 4399 prod_web3(i-ca0b05aa):~$ ulimit -n 1024
-1
votes
1answer
138 views

Open file count keeps increasing forever

I'm experiencing issues with the number of files opened increasing over time. If I run my server for about few hours, it'll no more accept any connections. The limit was 1024. I've increased the limit ...
2
votes
2answers
410 views

find owner and spawn process of ssh connection

There is this one server I manage which regularly (few times a minute) tries a connection to another machine on tcp port 22. (ssh) My question: how can I find the process that spawned this connection?...
1
vote
0answers
563 views

Apache web server maxing out due to processes stuck at D status

I have a Apache 2.2.3 web server running on a 8 core VM with 8G Ram. During a load test, the web server stopped responding and load average went up to 1000. When I run Top command, I see a large ...
2
votes
2answers
96 views

how can i see if an open filehandle is writeable or not on a linux system?

I can see with lsof that a process has an open filehandle for a particular file, but is there a way that I can see what kind of filehandle (ex: r, rw) it is?
1
vote
1answer
837 views

Near 100% disk usage, df and du show very different results, lsof not the answer

The issue is that my CentOS 5.8 machine is telling me that I am nearly out of disk space when I am pretty confident this is not the case. I've done a fair amount of researching on this issue and have ...
13
votes
3answers
2k views

Link to a specific inode

I have a file that was deleted, but is still held open by a program. I found the inode number using lsof. How can I create a hard link back to that inode?
1
vote
1answer
303 views

txt file descriptor in lsof

In my experience, files that have the file descriptor of txt in lsof output are the executable file itself and shared objects. The lsof man page says that it means "program text (code and data)". ...
1
vote
1answer
376 views

Linux: tell if file was opened with O_SYNC

Is there a way to tell if a process opened a file with the O_SYNC flag? I'm thinking lsof might be able to do this, but cannot find a way.
2
votes
2answers
196 views

How to map an ephemeral port to a pid?

I have a RHEL server with several apps on it and I am attempting to figure out which one of them is making calls to an external web service. I have TCP dumps that show the calls being made and through ...
7
votes
3answers
8k views

How to track down a file descriptor leak?

I have a java process (Glassfish) which is leaking file descriptors. I know this because I get the helpful java.io.IOException: Too many open files exception. I can look in /proc/PID#/fd and see all ...
3
votes
1answer
116 views

How can I list all accessed files on process startup

I have a process that fails on startup due to some permission issues. I want to check what files it tries to open on startup but with lsof I can list only opened files for a running process but what ...
1
vote
1answer
612 views

Custom lsof output

The following command produced the unix domain socket opened by PID 30661 $ sudo lsof -U -a -p 30661 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME haproxy 30661 haproxy 7u ...
0
votes
1answer
147 views

Monitoring a cgi-bin executable's file usage?

One of the programs in my cgi-bin folder is misbehaving. It's a compiled binary for which I do not have the source code. I would like to set up some kind of monitor to gather a list of the files that ...
0
votes
1answer
174 views

KVM how to determine which virtual disk files are in use by VMs

I tried lsof|grep *.qcow2 and got no results back (why is that? I definitely have VMs running using that disk format). I also considered grepping qcow2 on *.xml within the config directory, but this ...
1
vote
1answer
517 views

lsof displays restored file as deleted

If I create a file named /home/martin/testfile.txt, open this file with less utility, delete /home/martin/testfile.txt file and restore it from file descriptor directory under the /proc/31148, where ...
1
vote
4answers
6k views

apache listening on 80, but not on any other port

i wanted to change a working apache configuration of example.com (exampleIP = 1.2.3.4 ) to change from the default port 80 to port 8001, such that http://example.com:8001 should work. I wasn't able to ...
1
vote
2answers
159 views

How to configure Apache not to keep access.log or error.log open all the time for virtualhosts?

I want to lower number of open files on my VPS. With lsof I noticed that Apache constantly keeps access.log and error.log open for each domain hosted on server. Is there a way to change this ...
1
vote
1answer
187 views

why in /proc file system have this infomation

run: lsof|grep delete can find some process open fd, but system said that it has been deleted: mingetty 2031 root txt REG 8,2 15256 49021039 /sbin/mingetty (deleted) I look in ...
1
vote
2answers
2k views

tracking down what files are causing io activity in iostat

Using iostat -Nkx 1 I can see that I am getting regular IO on a volume group. What I'm trying to do is find a way to link that IO to a file/pipe/whatever to see what process is creating this IO and ...
0
votes
2answers
1k views

What is the meaning of this result from running 'lsof -i:8080'?

When I run the following command: lsof -i:8080 This is the result: node 32419 root 6u IPv4 122865 TCP localhost.localdomain:webcache (LISTEN) That result is different from that of ...