Questions tagged [lsof]

Lsof is a tool to list opened files by processes

Filter by
Sorted by
Tagged with
0 votes
0 answers
11 views

Obtain path of opened filees in directory, but without symlink processing

I need to list each files opened by path containing specified prefix. I create own FUSE FS and need to gather directory, when last file opened by symlink in my FUSE FS is closed. But lsof /mount_point/...
user avatar
  • 101
0 votes
0 answers
64 views

kafka + File handle leak due a large number of pipe/eventpoll leak

we have kafka cluster on linux rhel version - 7.6 we notice too many open files on kafka machines but when we did lsof >/tmp/res_file form file /tmp/res_file , we can see many lines as java ...
user avatar
0 votes
1 answer
268 views

Find what is using disk space in CentOS 7 (du vs df vs lsof)

I have a server, CentOS 7, that show disk usage on DF way higher than you can see on DU and I trying to understand why DF shows 38GB used DU shows 14GB There is no mount point on any folder Checking ...
user avatar
1 vote
0 answers
128 views

Get information about socket of unknown domain

The output of lsof (revision: 4.87) on centos 7.8.2003 shows: COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME java 30858 xxxx 841u sock 0,7 ...
user avatar
0 votes
0 answers
280 views

netstat shows a listening port with no pid and can't find pid with rpcinfo and ss and lsof

I tried bind nc on port 41120, but it said port has already been used. So I want to find out which process binded this port and if I can kill it. I executed netstat  -taupen| grep  41120 and it shows ...
user avatar
  • 145
1 vote
0 answers
646 views

lsof hangs forever centos 7

Having an issue where lsof hangs forever. I thought it might have been caused by the NFS mount which was recently interrupted and remounted, however, I tried unmounting the NFS mount and it's still ...
user avatar
  • 39
0 votes
1 answer
226 views

How can I rsync a directory that might be busy with updating files?

I would like to transfer a directory of files to a remote destination. Easy. However, at any given time, one or many of these files may be in-use and being updated by users. This doesn't bother rsync ...
user avatar
1 vote
3 answers
2k views

How can a server accept incoming traffic to port 443 if it isn't listed in netstat?

I have a server that is currently accepting HTTPS requests and the only thing that shows with netstat -plnt is this: elijahlynn@web:~$ sudo netstat -plnt Active Internet connections (only servers) ...
user avatar
0 votes
1 answer
531 views

how to know if we reached the max value of fs.file-max

on our linux rhel servers fs.file-max set with 100000 sysctl -p | grep fs.file-max fs.file-max = 100000 from my understanding the file-max kernel parameter refers to open file descriptors, and file-...
user avatar
1 vote
1 answer
785 views

how to count the open files without lsof [closed]

we have in our cluster more then 800 rhel machines - version 7.2 since lsof | wc -l take too much time ( sometimes 3-4 min ) , in order to get the current open files we want to know if there are ...
user avatar
4 votes
1 answer
3k views

In lsof output what are those 'sock' lines?

In lsof command under Ubuntu/Debian, I'm seeing a lot of lines like below: PROGRAM 829 root 140u sock 0,8 0t0 244182 protocol: TCP What are these lines? Can they be results of ...
user avatar
  • 183
-1 votes
1 answer
37 views

Could anyone please tell what the lsof mean is? [duplicate]

please see this image Hi, there. please check this image. I had a suspicious IP address and I ran the last command. Anyone please tell what that lsof is? Did somebody run the lsof command on my ...
user avatar
  • 1
2 votes
1 answer
910 views

cant counting all open files by lsof + lsof is hung

we are tying to count all open files by lsof lsof | wc -l lsof: WARNING: can't stat() fuse.gvfsd-fuse file system /run/user/42/gvfs Output information may be incomplete. but sill after 1 hour ...
user avatar
  • 451
1 vote
0 answers
1k views

What are the steps to track down a 'too many open files' issue

I'm trying to track down and root cause a 'too many file open' issue on RHEL 7. From googling around, if I run this command it give me the open file count in the first column and the PID in the ...
user avatar
0 votes
1 answer
1k views

Kubernetes hostPort: invisible to lsof?

I am playing around with my own small Kubernetes cluster. Something that I don't understand so far is how to see all open ports (= everything my Pods are listening on). I use Traefik as ingress with ...
user avatar
0 votes
1 answer
322 views

what is role of cfinger in below output of lsof -i

I would like to understand the output of lsof -i, come with below response below, it looks like mystance is making outbond connection with 192.168.200.21 however on port section it says cfinger .i.e....
user avatar
0 votes
2 answers
870 views

mysqld process deleted in lsof

running lsof on the server today I came across that mysqld was showing up as deleted. Does anyone came across something like this before, or there is an explanation about this. Is it a bug? lsof | ...
user avatar
  • 52
2 votes
1 answer
3k views

lsof shows tmp growing file marked as deleted

I have a cron that generated a lot (15GB) of PHP warnings and was writing them in a log file. I killed the process and as a temporary measure I stopped redirecting stderr to stdout so I don't fill up ...
user avatar
  • 155
1 vote
1 answer
225 views

Working port invisible to lsof

On Server A CentOS 7, I enabled an iscsi target at portal 192.168.1.101:3260 (that ip is one of A's ips), so that from another Server B I can mount that iscsi target on Server A successfully. From ...
user avatar
  • 269
1 vote
1 answer
153 views

let lsof shows longer fd length

When I check a process which can use over 10000 file descriptors, lsof only shows 4 digit. (that is it can only show 9999) When over 10000, it start with a asterisk sign. For example: COMMAND PID ...
user avatar
1 vote
4 answers
12k views

"Logical volume in use" -- cannot remove logical volume

On a Xen 4.8 hypervisor, running on Debian Stretch, I am trying to remove the logical volume of a domU that is no longer used. I stopped the domU and successfully removed the logical volume for the ...
user avatar
0 votes
1 answer
344 views

Check Used Ports on Linux without Command [closed]

Is there a way to check Used Ports on Linux without commands, I mean checking files or so on ?
user avatar
-1 votes
1 answer
32 views

Verify that Logging is up and enabled

COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME httpd 1744 apache 16w REG 202,1 0 167906281 phpapi_access_log httpd 2334 apache 16w REG 202,1 0 167906281 ...
user avatar
  • 21
5 votes
3 answers
13k views

Getting PID from lsof list

I have a react-native application and I want to write a script for start test version. I need to shotdown the :8081 port if it is alive. The command: lsof -i :8081 kill -9 <PID> The lsof ...
user avatar
12 votes
2 answers
2k views

non-cpu-intensive alternative to lsof?

We run an Apache Cassandra cluster where each host has a few hundred thousand files open at any given time. We'd like to be able to get a count of open files at periodic intervals and feed this ...
user avatar
2 votes
1 answer
6k views

Linux : Count Open Files for Process

How can I check how many open files are currently used? Checking on PM2 is just an example: I found the PID: ps aux | grep pm2 | awk '{ print $2 }' Checked that there is a limit of 65536 ...
user avatar
1 vote
0 answers
937 views

Why is lsof showing these ESTABLISHED ipv6 connections?

I'm trying to track down why a web application is accumulating file descriptors, in the form of connections to clients, even when the clients (browsers) have disconnected. The server is running ...
user avatar
  • 121
2 votes
1 answer
2k views

What does the lsof -c flag filter out?

lsof will show a table with the first column being the command name and each row, an open file. So to only show rows from a specific command, say "java", it would make sense to try lsof | grep ^java. ...
user avatar
  • 121
2 votes
1 answer
497 views

nrpe user cant properly execute script remotely using lsof, netstat works

I created a simple script for nagios to check a port on a remote server. Originally, I tried to use lsof. #!/bin/bash RESULT=$(lsof -i :8080 | grep LISTEN) if [ -n "$RESULT" ] then echo "$...
user avatar
  • 609
0 votes
2 answers
7k views

How to kill/close log files that are open through lsof grep deleted?

I have a deleted a large log file from our servers. so I executed this command to validate. lsof -nP | grep '(deleted)' and this showed up. how can I permanently delete the results fo this lsof? I ...
user avatar
  • 101
0 votes
1 answer
815 views

How to combine lsof stat and ps to get more info in one line bash command

I can use lsof to get top open files stat for processes, as below: $ lsof -n|awk '{print $2}'|sort|uniq -c|sort -nr | head -n 5 17955 11945 10282 2786 5980 32152 1920 27803 1786 32107 ...
user avatar
  • 11
0 votes
2 answers
1k views

Why big difference between `lsof -p <pid> | wc -l` and `lsof | grep <pid> | wc -l`

I find an elasticsearch process in Ubntu 14.04 linux vm holding many file handlers, while when I use lsof to do further analysis, it just gives some confusing results as below: $ lsof -p | wc -l $ ...
user avatar
  • 11
6 votes
1 answer
12k views

unmounted logical volume is "busy"?

I'm trying to shrink an ext4 filesystem on a CentOS 6 server. I did a lazy unmount of the filesystem while I waited for some processes to finish running. They've all finished running but I can't ...
user avatar
  • 1,807
0 votes
2 answers
128 views

View what file started a process in linux

One of my servers started sending spam in heavy amounts. The server is using ISPConfig 3 and one of the web users most likely has a security breach. I have identified the user and one file somehow ...
user avatar
  • 1
1 vote
3 answers
935 views

How can I find out which script/program/user invokes exim (and is sending spam)?

The problem A client of mine asked me to take a look at his shared-hosting webserver for the following problem, but I'm stuck at finding out what's wrong. His server is being blacklisted by a lot of ...
user avatar
0 votes
0 answers
52 views

Monitor outgoing web traffic sources on CentOS [duplicate]

I received a report today that a server I manage (Centos + Apache) is launching a bruteforce attack against wordpress websites: hacked-joomla/brobot The requests sent look like this: x.x.x.x - - [...
user avatar
2 votes
1 answer
193 views

lsof returns "can't read vnode" error

On a Solaris 10 box, I am getting errors from lsof: can't read vnode at 0x7d900000000 can't read vnode at 0x7b But I have the same lsof binary in another similar Solaris 10 box where it doesn't give ...
user avatar
  • 448
0 votes
1 answer
73 views

Is there a way to know the duration for which the connection is open using lsof?

If not possible with lsof what other way to find the time for which the connection is open on a machine. Please do let me know if you need any other information.
user avatar
  • 253
0 votes
1 answer
118 views

find files which are not currently in use

I'm trying to archive some older files, but don't want to touch all the files which are currently in use. What's the best way to ask find to exclude "in use" files? Right now I'm working on this ...
user avatar
  • 101
3 votes
2 answers
2k views

lsof doesn't show the established TCP connection

On my system, if I run the netstat for a port, it returns: $ netstat -nat | grep "60964" tcp 0 0 192.0.0.1:60964 0.0.0.0:* LISTEN tcp 59 0 192.0.0....
user avatar
2 votes
1 answer
74 views

Is it possible to deterministically trace how port 80 is forwarded and where the configuration is on a given system?

Is there a way to determine or trace how a port forwarding configuration is set up on a system running Ubuntu 14.04 LTS, on which there is a NodeJS service running and somehow accepting connections ...
user avatar
2 votes
1 answer
5k views

Safe to kill a process called *:etlservicemgr (LISTEN)?

I am trying to serve locally to port 9001 but I get an listen EADDRINUSE error. When I look at the port with lsof -i :9001 it shows the following COMMAND PID USER FD TYPE DEVICE ...
user avatar
2 votes
1 answer
475 views

Process has more open sockets than should be allowed by prlimit

Running debian jessie. The following is done as root to avoid any permissions issues. First I find the pid of my program, then I check its open file limit to verify that it is set at 1024. But when I ...
user avatar
  • 226
8 votes
3 answers
12k views

lsof runs very slow in my server

I'm running lsof in one of my Linux server to check if one file (/tmp/incoming_data.txt) in the ext3 system is opened by other programs. My server has lots of TCP connection on it. The weird thing is ...
user avatar
  • 376
-3 votes
1 answer
914 views

Display only some of the lines of the lsof command [closed]

I am trying to create a bash script for displaying only certain lines of the lsof command. I have figured out that the lsof command itself lists information in the form of columns which show info ...
user avatar
0 votes
1 answer
603 views

Pipe lsof to grep to awk ps -ef to grep

I'm trying to get some info on a certain PID. I'm probably doing this in a manner that is way too difficult, but I'm trying to run this: lsof | grep grepstuff | awk '{ps -ef | grep $2;}' and I'm not ...
user avatar
  • 415
2 votes
1 answer
423 views

Regular and repetitive sudo alerts from several Linux hosts

I've got several hosts running CentOS 5.11 on the LAN. Lately we've been getting fairly regular sudo alerts (via email) from attempted sudo commands by non-authorized users. Been Googling in case the ...
user avatar
  • 61
1 vote
1 answer
49 views

Detect which scripts are using old interpreters

I have a few Debian machines with some nearly-orphaned script interpreters, for example /bin/bash3 and /usr/bin/perl510. How can I detect those scripts that still have the aforementioned interpreters ...
user avatar
  • 135
2 votes
1 answer
994 views

Incoming FTP transfer not showing in lsof when using specific FTP client

I've got a script that continuously monitors an FTP dropbox directory and processes new files when they come in. The script runs lsof on each file before it tries to process it to determine if the ...
user avatar
  • 41
1 vote
2 answers
1k views

Can I find the list of ports being listened by a process ordered by the time of opening?

I know I can see the list of open ports using the lsof command. I am trying to view the results ordered by timestamp of listening. The process opens multiple (~6) ports and I suspect the order of ...
user avatar