Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [lsof]

Lsof is a tool to list opened files by processes

0
votes
0answers
34 views

Why do i see a lot of deleted, but still open file handles to system files?

Partial output of lsof command. There're a lot more handles (# lsof 2>&1 | grep DEL.*\.so$ | wc -l shows 725), but they're ~ same as in provided part. Why is this happening and should i be ...
0
votes
0answers
27 views

lsof displays two connections from one port

I'm following lsof output for my process COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME AppName 79899 heximal 7u IPv4 0x6c18d5501d2e17c9 0t0 TCP 10.3.2.8:...
0
votes
1answer
249 views

Kubernetes hostPort: invisible to lsof?

I am playing around with my own small Kubernetes cluster. Something that I don't understand so far is how to see all open ports (= everything my Pods are listening on). I use Traefik as ingress with ...
0
votes
1answer
117 views

what is role of cfinger in below output of lsof -i

I would like to understand the output of lsof -i, come with below response below, it looks like mystance is making outbond connection with 192.168.200.21 however on port section it says cfinger .i.e....
0
votes
2answers
271 views

mysqld process deleted in lsof

running lsof on the server today I came across that mysqld was showing up as deleted. Does anyone came across something like this before, or there is an explanation about this. Is it a bug? lsof | ...
2
votes
1answer
717 views

lsof shows tmp growing file marked as deleted

I have a cron that generated a lot (15GB) of PHP warnings and was writing them in a log file. I killed the process and as a temporary measure I stopped redirecting stderr to stdout so I don't fill up ...
1
vote
1answer
157 views

Working port invisible to lsof

On Server A CentOS 7, I enabled an iscsi target at portal 192.168.1.101:3260 (that ip is one of A's ips), so that from another Server B I can mount that iscsi target on Server A successfully. From ...
1
vote
1answer
52 views

let lsof shows longer fd length

When I check a process which can use over 10000 file descriptors, lsof only shows 4 digit. (that is it can only show 9999) When over 10000, it start with a asterisk sign. For example: COMMAND PID ...
-1
votes
1answer
198 views

Check Used Ports on Linux without Command [closed]

Is there a way to check Used Ports on Linux without commands, I mean checking files or so on ?
-1
votes
1answer
22 views

Verify that Logging is up and enabled

COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME httpd 1744 apache 16w REG 202,1 0 167906281 phpapi_access_log httpd 2334 apache 16w REG 202,1 0 167906281 ...
2
votes
2answers
3k views

Getting PID from lsof list

I have a react-native application and I want to write a script for start test version. I need to shotdown the :8081 port if it is alive. The command: lsof -i :8081 kill -9 <PID> The lsof ...
12
votes
2answers
1k views

non-cpu-intensive alternative to lsof?

We run an Apache Cassandra cluster where each host has a few hundred thousand files open at any given time. We'd like to be able to get a count of open files at periodic intervals and feed this ...
1
vote
0answers
3k views

Linux : Count Open Files for Process

How can I check how many open files are currently used? Checking on PM2 is just an example: I found the PID: ps aux | grep pm2 | awk '{ print $2 }' Checked that there is a limit of 65536 ...
0
votes
0answers
468 views

Why is lsof showing these ESTABLISHED ipv6 connections?

I'm trying to track down why a web application is accumulating file descriptors, in the form of connections to clients, even when the clients (browsers) have disconnected. The server is running ...
1
vote
1answer
384 views

What does the lsof -c flag filter out?

lsof will show a table with the first column being the command name and each row, an open file. So to only show rows from a specific command, say "java", it would make sense to try lsof | grep ^java. ...
1
vote
1answer
328 views

nrpe user cant properly execute script remotely using lsof, netstat works

I created a simple script for nagios to check a port on a remote server. Originally, I tried to use lsof. #!/bin/bash RESULT=$(lsof -i :8080 | grep LISTEN) if [ -n "$RESULT" ] then echo "$...
0
votes
2answers
2k views

How to kill/close log files that are open through lsof grep deleted?

I have a deleted a large log file from our servers. so I executed this command to validate. lsof -nP | grep '(deleted)' and this showed up. how can I permanently delete the results fo this lsof? I ...
0
votes
1answer
683 views

How to combine lsof stat and ps to get more info in one line bash command

I can use lsof to get top open files stat for processes, as below: $ lsof -n|awk '{print $2}'|sort|uniq -c|sort -nr | head -n 5 17955 11945 10282 2786 5980 32152 1920 27803 1786 32107 ...
0
votes
2answers
625 views

Why big difference between `lsof -p <pid> | wc -l` and `lsof | grep <pid> | wc -l`

I find an elasticsearch process in Ubntu 14.04 linux vm holding many file handlers, while when I use lsof to do further analysis, it just gives some confusing results as below: $ lsof -p | wc -l $ ...
3
votes
1answer
6k views

unmounted logical volume is “busy”?

I'm trying to shrink an ext4 filesystem on a CentOS 6 server. I did a lazy unmount of the filesystem while I waited for some processes to finish running. They've all finished running but I can't ...
0
votes
2answers
99 views

View what file started a process in linux

One of my servers started sending spam in heavy amounts. The server is using ISPConfig 3 and one of the web users most likely has a security breach. I have identified the user and one file somehow ...
1
vote
3answers
440 views

How can I find out which script/program/user invokes exim (and is sending spam)?

The problem A client of mine asked me to take a look at his shared-hosting webserver for the following problem, but I'm stuck at finding out what's wrong. His server is being blacklisted by a lot of ...
0
votes
0answers
51 views

Monitor outgoing web traffic sources on CentOS [duplicate]

I received a report today that a server I manage (Centos + Apache) is launching a bruteforce attack against wordpress websites: hacked-joomla/brobot The requests sent look like this: x.x.x.x - - [...
2
votes
1answer
147 views

lsof returns “can't read vnode” error

On a Solaris 10 box, I am getting errors from lsof: can't read vnode at 0x7d900000000 can't read vnode at 0x7b But I have the same lsof binary in another similar Solaris 10 box where it doesn't give ...
0
votes
1answer
60 views

Is there a way to know the duration for which the connection is open using lsof?

If not possible with lsof what other way to find the time for which the connection is open on a machine. Please do let me know if you need any other information.
0
votes
1answer
104 views

find files which are not currently in use

I'm trying to archive some older files, but don't want to touch all the files which are currently in use. What's the best way to ask find to exclude "in use" files? Right now I'm working on this ...
2
votes
2answers
1k views

lsof doesn't show the established TCP connection

On my system, if I run the netstat for a port, it returns: $ netstat -nat | grep "60964" tcp 0 0 192.0.0.1:60964 0.0.0.0:* LISTEN tcp 59 0 192.0.0....
2
votes
1answer
67 views

Is it possible to deterministically trace how port 80 is forwarded and where the configuration is on a given system?

Is there a way to determine or trace how a port forwarding configuration is set up on a system running Ubuntu 14.04 LTS, on which there is a NodeJS service running and somehow accepting connections ...
1
vote
1answer
3k views

Safe to kill a process called *:etlservicemgr (LISTEN)?

I am trying to serve locally to port 9001 but I get an listen EADDRINUSE error. When I look at the port with lsof -i :9001 it shows the following COMMAND PID USER FD TYPE DEVICE ...
2
votes
1answer
292 views

Process has more open sockets than should be allowed by prlimit

Running debian jessie. The following is done as root to avoid any permissions issues. First I find the pid of my program, then I check its open file limit to verify that it is set at 1024. But when I ...
8
votes
2answers
5k views

lsof runs very slow in my server

I'm running lsof in one of my Linux server to check if one file (/tmp/incoming_data.txt) in the ext3 system is opened by other programs. My server has lots of TCP connection on it. The weird thing is ...
-3
votes
1answer
555 views

Display only some of the lines of the lsof command [closed]

I am trying to create a bash script for displaying only certain lines of the lsof command. I have figured out that the lsof command itself lists information in the form of columns which show info ...
0
votes
1answer
445 views

Pipe lsof to grep to awk ps -ef to grep

I'm trying to get some info on a certain PID. I'm probably doing this in a manner that is way too difficult, but I'm trying to run this: lsof | grep grepstuff | awk '{ps -ef | grep $2;}' and I'm not ...
2
votes
1answer
396 views

Regular and repetitive sudo alerts from several Linux hosts

I've got several hosts running CentOS 5.11 on the LAN. Lately we've been getting fairly regular sudo alerts (via email) from attempted sudo commands by non-authorized users. Been Googling in case the ...
1
vote
1answer
41 views

Detect which scripts are using old interpreters

I have a few Debian machines with some nearly-orphaned script interpreters, for example /bin/bash3 and /usr/bin/perl510. How can I detect those scripts that still have the aforementioned interpreters ...
2
votes
1answer
627 views

Incoming FTP transfer not showing in lsof when using specific FTP client

I've got a script that continuously monitors an FTP dropbox directory and processes new files when they come in. The script runs lsof on each file before it tries to process it to determine if the ...
1
vote
2answers
920 views

Can I find the list of ports being listened by a process ordered by the time of opening?

I know I can see the list of open ports using the lsof command. I am trying to view the results ordered by timestamp of listening. The process opens multiple (~6) ports and I suspect the order of ...
0
votes
1answer
1k views

lsof getting ran by root, but not by a user and using high CPU usage

My server is using high CPU usage from lsof, and it appears to be ran randomly and by the root user. I'm finding this out via Newrelic information Is it at all possible to find what is running this ...
0
votes
1answer
608 views

Open file count keeps increasing forever

I'm experiencing issues with the number of files opened increasing over time. If I run my server for about few hours, it'll no more accept any connections. The limit was 1024. I've increased the limit ...
3
votes
3answers
3k views

How to find full process arguments and associated listening ports?

I can execute netstat -atulpn | grep java to find all Java processes with their accompanying ports, which is great, however I would like to also have the processes full execution arguments also shown. ...
2
votes
2answers
679 views

find owner and spawn process of ssh connection

There is this one server I manage which regularly (few times a minute) tries a connection to another machine on tcp port 22. (ssh) My question: how can I find the process that spawned this connection?...
2
votes
0answers
1k views

Apache web server maxing out due to processes stuck at D status

I have a Apache 2.2.3 web server running on a 8 core VM with 8G Ram. During a load test, the web server stopped responding and load average went up to 1000. When I run Top command, I see a large ...
2
votes
2answers
320 views

how can i see if an open filehandle is writeable or not on a linux system?

I can see with lsof that a process has an open filehandle for a particular file, but is there a way that I can see what kind of filehandle (ex: r, rw) it is?
3
votes
1answer
1k views

Near 100% disk usage, df and du show very different results, lsof not the answer

The issue is that my CentOS 5.8 machine is telling me that I am nearly out of disk space when I am pretty confident this is not the case. I've done a fair amount of researching on this issue and have ...
1
vote
1answer
779 views

txt file descriptor in lsof

In my experience, files that have the file descriptor of txt in lsof output are the executable file itself and shared objects. The lsof man page says that it means "program text (code and data)". ...
2
votes
2answers
620 views

How to map an ephemeral port to a pid?

I have a RHEL server with several apps on it and I am attempting to figure out which one of them is making calls to an external web service. I have TCP dumps that show the calls being made and through ...
1
vote
1answer
599 views

Linux: tell if file was opened with O_SYNC

Is there a way to tell if a process opened a file with the O_SYNC flag? I'm thinking lsof might be able to do this, but cannot find a way.
4
votes
1answer
626 views

How can I list all accessed files on process startup

I have a process that fails on startup due to some permission issues. I want to check what files it tries to open on startup but with lsof I can list only opened files for a running process but what ...
2
votes
1answer
3k views

Custom lsof output

The following command produced the unix domain socket opened by PID 30661 $ sudo lsof -U -a -p 30661 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME haproxy 30661 haproxy 7u ...
0
votes
1answer
313 views

Monitoring a cgi-bin executable's file usage?

One of the programs in my cgi-bin folder is misbehaving. It's a compiled binary for which I do not have the source code. I would like to set up some kind of monitor to gather a list of the files that ...