Questions tagged [lsof]
Lsof is a tool to list opened files by processes
104
questions
0
votes
0
answers
35
views
fuser not listing the process even netstat and lsof list
hostserver:~# lsof | grep *:6343
sflowtool 979324 root 3u IPv6 1443815323 0t0 UDP *:6343
hostserver:~# netstat -ntlup | grep 6343
udp6 0 ...
- 101
0
votes
1
answer
90
views
How to track file lifetime using lsof?
I have read article https://tailscale.com/blog/case-of-spiky-file-descriptors/ where author investigates anomalies with the amount of open file descriptors.
He said that made snapshot of open files ...
0
votes
1
answer
183
views
Debian 11, multiple Solr versions running on different ports, lsof says that Solr9 is accessible only from localhost.localdomain
I have a Debian 9 server that is running Solr 7.3.
I have upgraded to Debian 11, Solr is still fine.
Now I'm trying to install Solr 9 alongside Solr 7.3, to have both versions running in the same time....
- 505
0
votes
0
answers
15
views
Centos 7.4, dev/vda1 is 100% [duplicate]
My VPS on DO now has an issue of dev/vda1 is 100% since around 3 months ago, at that time, I did poweroff & reboot then disk spaced freed.
But the thing rans into some bigger issue since 1 week ...
- 21
0
votes
1
answer
2k
views
Find what is using disk space in CentOS 7 (du vs df vs lsof)
I have a server, CentOS 7, that show disk usage on DF way higher than you can see on DU and I trying to understand why
DF shows 38GB used
DU shows 14GB
There is no mount point on any folder
Checking ...
- 23
1
vote
0
answers
253
views
Get information about socket of unknown domain
The output of lsof (revision: 4.87) on centos 7.8.2003 shows:
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
java 30858 xxxx 841u sock 0,7 ...
- 204
0
votes
0
answers
783
views
netstat shows a listening port with no pid and can't find pid with rpcinfo and ss and lsof
I tried bind nc on port 41120, but it said port has already been used. So I want to find out which process binded this port and if I can kill it. I executed netstat -taupen| grep 41120 and it shows ...
- 195
1
vote
0
answers
1k
views
lsof hangs forever centos 7
Having an issue where lsof hangs forever. I thought it might have been caused by the NFS mount which was recently interrupted and remounted, however, I tried unmounting the NFS mount and it's still ...
- 39
0
votes
1
answer
374
views
How can I rsync a directory that might be busy with updating files?
I would like to transfer a directory of files to a remote destination. Easy.
However, at any given time, one or many of these files may be in-use and being updated by users.
This doesn't bother rsync ...
- 209
1
vote
3
answers
3k
views
How can a server accept incoming traffic to port 443 if it isn't listed in netstat?
I have a server that is currently accepting HTTPS requests and the only thing that shows with netstat -plnt is this:
elijahlynn@web:~$ sudo netstat -plnt
Active Internet connections (only servers)
...
- 141
0
votes
1
answer
1k
views
how to know if we reached the max value of fs.file-max
on our linux rhel servers fs.file-max set with 100000
sysctl -p | grep fs.file-max
fs.file-max = 100000
from my understanding the file-max kernel parameter refers to open file descriptors, and file-...
- 559
1
vote
1
answer
3k
views
how to count the open files without lsof [closed]
we have in our cluster more then 800 rhel machines - version 7.2
since lsof | wc -l
take too much time ( sometimes 3-4 min ) , in order to get the current open files
we want to know if there are ...
- 559
4
votes
1
answer
4k
views
In lsof output what are those 'sock' lines?
In lsof command under Ubuntu/Debian, I'm seeing a lot of lines like below:
PROGRAM 829 root 140u sock 0,8 0t0 244182 protocol: TCP
What are these lines?
Can they be results of ...
- 191
-1
votes
1
answer
60
views
Could anyone please tell what the lsof mean is? [duplicate]
please see this image
Hi, there. please check this image.
I had a suspicious IP address and I ran the last command.
Anyone please tell what that lsof is? Did somebody run the lsof command on my ...
- 1
2
votes
1
answer
2k
views
cant counting all open files by lsof + lsof is hung
we are tying to count all open files by lsof
lsof | wc -l
lsof: WARNING: can't stat() fuse.gvfsd-fuse file system /run/user/42/gvfs
Output information may be incomplete.
but sill after 1 hour ...
- 471
1
vote
0
answers
1k
views
What are the steps to track down a 'too many open files' issue
I'm trying to track down and root cause a 'too many file open' issue on RHEL 7.
From googling around, if I run this command it give me the open file count in the first column and the PID in the ...
- 111
0
votes
1
answer
1k
views
Kubernetes hostPort: invisible to lsof?
I am playing around with my own small Kubernetes cluster.
Something that I don't understand so far is how to see all open ports (= everything my Pods are listening on).
I use Traefik as ingress with ...
0
votes
1
answer
389
views
what is role of cfinger in below output of lsof -i
I would like to understand the output of lsof -i, come with below response
below, it looks like mystance is making outbond connection with 192.168.200.21 however on port section it says cfinger .i.e....
- 111
0
votes
2
answers
1k
views
mysqld process deleted in lsof
running lsof on the server today I came across that mysqld was showing up as deleted. Does anyone came across something like this before, or there is an explanation about this. Is it a bug?
lsof | ...
- 72
2
votes
1
answer
4k
views
lsof shows tmp growing file marked as deleted
I have a cron that generated a lot (15GB) of PHP warnings and was writing them in a log file.
I killed the process and as a temporary measure I stopped redirecting stderr to stdout so I don't fill up ...
- 155
1
vote
1
answer
355
views
Working port invisible to lsof
On Server A CentOS 7, I enabled an iscsi target at portal 192.168.1.101:3260 (that ip is one of A's ips), so that from another Server B I can mount that iscsi target on Server A successfully.
From ...
- 369
1
vote
1
answer
249
views
let lsof shows longer fd length
When I check a process which can use over 10000 file descriptors, lsof only shows 4 digit. (that is it can only show 9999)
When over 10000, it start with a asterisk sign. For example:
COMMAND PID ...
- 11
2
votes
5
answers
21k
views
"Logical volume in use" -- cannot remove logical volume
On a Xen 4.8 hypervisor, running on Debian Stretch, I am trying to remove the logical volume of a domU that is no longer used.
I stopped the domU and successfully removed the logical volume for the ...
- 121
0
votes
1
answer
432
views
Check Used Ports on Linux without Command [closed]
Is there a way to check Used Ports on Linux without commands, I mean checking files or so on ?
- 45
-1
votes
1
answer
42
views
Verify that Logging is up and enabled
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
httpd 1744 apache 16w REG 202,1 0 167906281 phpapi_access_log
httpd 2334 apache 16w REG 202,1 0 167906281 ...
- 21
9
votes
3
answers
18k
views
Getting PID from lsof list
I have a react-native application and I want to write a script for start test version. I need to shotdown the :8081 port if it is alive. The command:
lsof -i :8081
kill -9 <PID>
The lsof ...
- 345
12
votes
2
answers
3k
views
non-cpu-intensive alternative to lsof?
We run an Apache Cassandra cluster where each host has a few hundred thousand files open at any given time.
We'd like to be able to get a count of open files at periodic intervals and feed this ...
- 2,665
2
votes
1
answer
7k
views
Linux : Count Open Files for Process
How can I check how many open files are currently used?
Checking on PM2 is just an example:
I found the PID:
ps aux | grep pm2 | awk '{ print $2 }'
Checked that there is a limit of 65536 ...
- 123
1
vote
0
answers
1k
views
Why is lsof showing these ESTABLISHED ipv6 connections?
I'm trying to track down why a web application is accumulating file descriptors, in the form of connections to clients, even when the clients (browsers) have disconnected.
The server is running ...
- 121
2
votes
1
answer
3k
views
What does the lsof -c flag filter out?
lsof will show a table with the first column being the command name and each row, an open file. So to only show rows from a specific command, say "java", it would make sense to try lsof | grep ^java. ...
- 121
2
votes
1
answer
582
views
nrpe user cant properly execute script remotely using lsof, netstat works
I created a simple script for nagios to check a port on a remote server. Originally, I tried to use lsof.
#!/bin/bash
RESULT=$(lsof -i :8080 | grep LISTEN)
if [ -n "$RESULT" ]
then
echo "$...
- 639
0
votes
2
answers
8k
views
How to kill/close log files that are open through lsof grep deleted?
I have a deleted a large log file from our servers. so I executed this command to validate.
lsof -nP | grep '(deleted)'
and this showed up.
how can I permanently delete the results fo this lsof? I ...
- 101
0
votes
1
answer
886
views
How to combine lsof stat and ps to get more info in one line bash command
I can use lsof to get top open files stat for processes, as below:
$ lsof -n|awk '{print $2}'|sort|uniq -c|sort -nr | head -n 5
17955 11945
10282 2786
5980 32152
1920 27803
1786 32107
...
- 11
0
votes
2
answers
1k
views
Why big difference between `lsof -p <pid> | wc -l` and `lsof | grep <pid> | wc -l`
I find an elasticsearch process in Ubntu 14.04 linux vm holding many file handlers, while when I use lsof to do further analysis, it just gives some confusing results as below:
$ lsof -p | wc -l
$ ...
- 11
6
votes
1
answer
15k
views
unmounted logical volume is "busy"?
I'm trying to shrink an ext4 filesystem on a CentOS 6 server. I did a lazy unmount of the filesystem while I waited for some processes to finish running. They've all finished running but I can't ...
- 1,867
0
votes
2
answers
161
views
View what file started a process in linux
One of my servers started sending spam in heavy amounts. The server is using ISPConfig 3 and one of the web users most likely has a security breach.
I have identified the user and one file somehow ...
- 1
1
vote
3
answers
1k
views
How can I find out which script/program/user invokes exim (and is sending spam)?
The problem
A client of mine asked me to take a look at his shared-hosting webserver for the following problem, but I'm stuck at finding out what's wrong. His server is being blacklisted by a lot of ...
- 63
0
votes
0
answers
52
views
Monitor outgoing web traffic sources on CentOS [duplicate]
I received a report today that a server I manage (Centos + Apache) is launching a bruteforce attack against wordpress websites:
hacked-joomla/brobot
The requests sent look like this:
x.x.x.x - - [...
2
votes
1
answer
208
views
lsof returns "can't read vnode" error
On a Solaris 10 box, I am getting errors from lsof:
can't read vnode at 0x7d900000000
can't read vnode at 0x7b
But I have the same lsof binary in another similar Solaris 10 box where it doesn't give ...
- 468
0
votes
1
answer
105
views
Is there a way to know the duration for which the connection is open using lsof?
If not possible with lsof what other way to find the time for which the connection is open on a machine.
Please do let me know if you need any other information.
- 253
0
votes
1
answer
145
views
find files which are not currently in use
I'm trying to archive some older files, but don't want to touch all the files which are currently in use. What's the best way to ask find to exclude "in use" files?
Right now I'm working on this ...
- 101
3
votes
3
answers
3k
views
lsof doesn't show the established TCP connection
On my system, if I run the netstat for a port, it returns:
$ netstat -nat | grep "60964"
tcp 0 0 192.0.0.1:60964 0.0.0.0:* LISTEN
tcp 59 0 192.0.0....
- 155
2
votes
1
answer
79
views
Is it possible to deterministically trace how port 80 is forwarded and where the configuration is on a given system?
Is there a way to determine or trace how a port forwarding configuration is set up on a system running Ubuntu 14.04 LTS, on which there is a NodeJS service running and somehow accepting connections ...
- 163
2
votes
1
answer
6k
views
Safe to kill a process called *:etlservicemgr (LISTEN)?
I am trying to serve locally to port 9001 but I get an listen EADDRINUSE error. When I look at the port with lsof -i :9001 it shows the following
COMMAND PID USER FD TYPE DEVICE ...
- 21
2
votes
1
answer
588
views
Process has more open sockets than should be allowed by prlimit
Running debian jessie. The following is done as root to avoid any permissions issues.
First I find the pid of my program, then I check its open file limit to verify that it is set at 1024. But when I ...
- 236
8
votes
3
answers
14k
views
lsof runs very slow in my server
I'm running lsof in one of my Linux server to check if one file (/tmp/incoming_data.txt) in the ext3 system is opened by other programs. My server has lots of TCP connection on it. The weird thing is ...
- 386
-3
votes
1
answer
1k
views
Display only some of the lines of the lsof command [closed]
I am trying to create a bash script for displaying only certain lines of the lsof command. I have figured out that the lsof command itself lists information in the form of columns which show info ...
- 3
0
votes
1
answer
743
views
Pipe lsof to grep to awk ps -ef to grep
I'm trying to get some info on a certain PID. I'm probably doing this in a manner that is way too difficult, but I'm trying to run this:
lsof | grep grepstuff | awk '{ps -ef | grep $2;}'
and I'm not ...
- 415
2
votes
1
answer
438
views
Regular and repetitive sudo alerts from several Linux hosts
I've got several hosts running CentOS 5.11 on the LAN. Lately we've been getting fairly regular sudo alerts (via email) from attempted sudo commands by non-authorized users. Been Googling in case the ...
- 61
1
vote
1
answer
50
views
Detect which scripts are using old interpreters
I have a few Debian machines with some nearly-orphaned script interpreters, for example /bin/bash3 and /usr/bin/perl510. How can I detect those scripts that still have the aforementioned interpreters ...
- 135