How do I tell lsof I need to list only physical files (not sockets, not TCP/IP connections, only physical files)?
Just looked through some man pages, it appears you use the command:
sudo lsof /
This will list all open files in the / directory, which is everything on a Linux filesystem. Just tested and it shows only REG and DIR.
lsof -a -d 0-999 -c <command name> / lsof -a -d 0-999 -p <pid> /
0-999 limits it to files with a file descriptor number.
This is what I did which worked perfectly for me:
lsof -F n -p 12501 | grep ^n/ | cut -c2- | sort -u
-F n option to
lsof will cause it to only print out the names of the open files. Each output line that has the name of an open file will start with the single character n followed immediately by the name. Regular files will always be the absolute, fully-qualified name of the file. The
grep ^n/ will select only those lines with a name starting with a
/ (meaning an absolute, fully-qualified file name); thus eliminating things like open ports, sockets, pipe (like FIFOs), etc. The
cut -c2- will eliminate the first character, the
n, leaving only the file name. Then finally, the
sort -u will eliminate any duplicate entries.
One caveat, this will include files that are not regular as long as their name starts with a
/. For example, all files starting with the following would be included:
And there may be others depending on your OS.
If you use
lsof / it will just list open files on filesystems mounted DIRECTLY under / - that is, if you have /home mounted under /, its contents will be ignored. I tried various combination of options for lsof, but all had problems. The best I could come up is this:
lsof `readlink -f /dev/block/*`
This uses readlink -f to get all block devices and feed them as a list to search. lsof ignores the ones that are not mounted.
If you have any other options to limit the search, for instance a pid, remember to end the lsof command with an
-a to AND them with the list of block devices:
lsof -p 982482 -a `readlink -f /dev/block/*`