Questions tagged [lsof]

Lsof is a tool to list opened files by processes

Filter by
Sorted by
Tagged with
0
votes
1answer
18 views

How can I rsync a directory that might be busy with updating files?

I would like to transfer a directory of files to a remote destination. Easy. However, at any given time, one or many of these files may be in-use and being updated by users. This doesn't bother rsync ...
0
votes
0answers
10 views

How to find out which http/s request is blocked due to hosts file?

I saw many packets on loopback (lo0) interface on wireshark and tcpdump like this 171 1118.753013 127.0.0.1 127.0.0.1 443 TCP 68 54857 → 443 [SYN] Seq=0 Win=65535 Len=0 MSS=16344 WS=32 TSval=...
1
vote
2answers
62 views

How can a server accept incoming traffic to port 443 if it isn't listed in netstat?

I have a server that is currently accepting HTTPS requests and the only thing that shows with netstat -plnt is this: elijahlynn@web:~$ sudo netstat -plnt Active Internet connections (only servers) ...
0
votes
1answer
32 views

how to know if we reached the max value of fs.file-max

on our linux rhel servers fs.file-max set with 100000 sysctl -p | grep fs.file-max fs.file-max = 100000 from my understanding the file-max kernel parameter refers to open file descriptors, and file-...
0
votes
1answer
27 views

how to count the open files without lsof [closed]

we have in our cluster more then 800 rhel machines - version 7.2 since lsof | wc -l take too much time ( sometimes 3-4 min ) , in order to get the current open files we want to know if there are ...
2
votes
1answer
141 views

In lsof output what are those 'sock' lines?

In lsof command under Ubuntu/Debian, I'm seeing a lot of lines like below: PROGRAM 829 root 140u sock 0,8 0t0 244182 protocol: TCP What are these lines? Can they be results of ...
-1
votes
1answer
33 views

Could anyone please tell what the lsof mean is? [duplicate]

please see this image Hi, there. please check this image. I had a suspicious IP address and I ran the last command. Anyone please tell what that lsof is? Did somebody run the lsof command on my ...
0
votes
0answers
59 views

lsof + is it possible to force ending of (close wait) connections?

when we run lsof on port 6060 as the following # lsof -i TCP:6060 | more COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME app_lot 3495 root 12u IPv6 9238779 1t0 TCP *:krb0934 (...
0
votes
1answer
117 views

cant counting all open files by lsof + lsof is hung

we are tying to count all open files by lsof lsof | wc -l lsof: WARNING: can't stat() fuse.gvfsd-fuse file system /run/user/42/gvfs Output information may be incomplete. but sill after 1 hour ...
1
vote
0answers
215 views

What are the steps to track down a 'too many open files' issue

I'm trying to track down and root cause a 'too many file open' issue on RHEL 7. From googling around, if I run this command it give me the open file count in the first column and the PID in the ...
0
votes
0answers
56 views

Why do i see a lot of deleted, but still open file handles to system files?

Partial output of lsof command. There're a lot more handles (# lsof 2>&1 | grep DEL.*\.so$ | wc -l shows 725), but they're ~ same as in provided part. Why is this happening and should i be ...
0
votes
1answer
519 views

Kubernetes hostPort: invisible to lsof?

I am playing around with my own small Kubernetes cluster. Something that I don't understand so far is how to see all open ports (= everything my Pods are listening on). I use Traefik as ingress with ...
0
votes
1answer
228 views

what is role of cfinger in below output of lsof -i

I would like to understand the output of lsof -i, come with below response below, it looks like mystance is making outbond connection with 192.168.200.21 however on port section it says cfinger .i.e....
0
votes
2answers
519 views

mysqld process deleted in lsof

running lsof on the server today I came across that mysqld was showing up as deleted. Does anyone came across something like this before, or there is an explanation about this. Is it a bug? lsof | ...
2
votes
1answer
1k views

lsof shows tmp growing file marked as deleted

I have a cron that generated a lot (15GB) of PHP warnings and was writing them in a log file. I killed the process and as a temporary measure I stopped redirecting stderr to stdout so I don't fill up ...
1
vote
1answer
175 views

Working port invisible to lsof

On Server A CentOS 7, I enabled an iscsi target at portal 192.168.1.101:3260 (that ip is one of A's ips), so that from another Server B I can mount that iscsi target on Server A successfully. From ...
1
vote
1answer
72 views

let lsof shows longer fd length

When I check a process which can use over 10000 file descriptors, lsof only shows 4 digit. (that is it can only show 9999) When over 10000, it start with a asterisk sign. For example: COMMAND PID ...
1
vote
3answers
3k views

“Logical volume in use” — cannot remove logical volume

On a Xen 4.8 hypervisor, running on Debian Stretch, I am trying to remove the logical volume of a domU that is no longer used. I stopped the domU and successfully removed the logical volume for the ...
-1
votes
1answer
294 views

Check Used Ports on Linux without Command [closed]

Is there a way to check Used Ports on Linux without commands, I mean checking files or so on ?
-1
votes
1answer
27 views

Verify that Logging is up and enabled

COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME httpd 1744 apache 16w REG 202,1 0 167906281 phpapi_access_log httpd 2334 apache 16w REG 202,1 0 167906281 ...
2
votes
2answers
7k views

Getting PID from lsof list

I have a react-native application and I want to write a script for start test version. I need to shotdown the :8081 port if it is alive. The command: lsof -i :8081 kill -9 <PID> The lsof ...
12
votes
2answers
2k views

non-cpu-intensive alternative to lsof?

We run an Apache Cassandra cluster where each host has a few hundred thousand files open at any given time. We'd like to be able to get a count of open files at periodic intervals and feed this ...
1
vote
1answer
4k views

Linux : Count Open Files for Process

How can I check how many open files are currently used? Checking on PM2 is just an example: I found the PID: ps aux | grep pm2 | awk '{ print $2 }' Checked that there is a limit of 65536 ...
1
vote
0answers
646 views

Why is lsof showing these ESTABLISHED ipv6 connections?

I'm trying to track down why a web application is accumulating file descriptors, in the form of connections to clients, even when the clients (browsers) have disconnected. The server is running ...
1
vote
1answer
757 views

What does the lsof -c flag filter out?

lsof will show a table with the first column being the command name and each row, an open file. So to only show rows from a specific command, say "java", it would make sense to try lsof | grep ^java. ...
2
votes
1answer
395 views

nrpe user cant properly execute script remotely using lsof, netstat works

I created a simple script for nagios to check a port on a remote server. Originally, I tried to use lsof. #!/bin/bash RESULT=$(lsof -i :8080 | grep LISTEN) if [ -n "$RESULT" ] then echo "$...
0
votes
2answers
3k views

How to kill/close log files that are open through lsof grep deleted?

I have a deleted a large log file from our servers. so I executed this command to validate. lsof -nP | grep '(deleted)' and this showed up. how can I permanently delete the results fo this lsof? I ...
0
votes
1answer
748 views

How to combine lsof stat and ps to get more info in one line bash command

I can use lsof to get top open files stat for processes, as below: $ lsof -n|awk '{print $2}'|sort|uniq -c|sort -nr | head -n 5 17955 11945 10282 2786 5980 32152 1920 27803 1786 32107 ...
0
votes
2answers
817 views

Why big difference between `lsof -p <pid> | wc -l` and `lsof | grep <pid> | wc -l`

I find an elasticsearch process in Ubntu 14.04 linux vm holding many file handlers, while when I use lsof to do further analysis, it just gives some confusing results as below: $ lsof -p | wc -l $ ...
4
votes
1answer
8k views

unmounted logical volume is “busy”?

I'm trying to shrink an ext4 filesystem on a CentOS 6 server. I did a lazy unmount of the filesystem while I waited for some processes to finish running. They've all finished running but I can't ...
0
votes
2answers
101 views

View what file started a process in linux

One of my servers started sending spam in heavy amounts. The server is using ISPConfig 3 and one of the web users most likely has a security breach. I have identified the user and one file somehow ...
1
vote
3answers
559 views

How can I find out which script/program/user invokes exim (and is sending spam)?

The problem A client of mine asked me to take a look at his shared-hosting webserver for the following problem, but I'm stuck at finding out what's wrong. His server is being blacklisted by a lot of ...
0
votes
0answers
52 views

Monitor outgoing web traffic sources on CentOS [duplicate]

I received a report today that a server I manage (Centos + Apache) is launching a bruteforce attack against wordpress websites: hacked-joomla/brobot The requests sent look like this: x.x.x.x - - [...
2
votes
1answer
162 views

lsof returns “can't read vnode” error

On a Solaris 10 box, I am getting errors from lsof: can't read vnode at 0x7d900000000 can't read vnode at 0x7b But I have the same lsof binary in another similar Solaris 10 box where it doesn't give ...
0
votes
1answer
65 views

Is there a way to know the duration for which the connection is open using lsof?

If not possible with lsof what other way to find the time for which the connection is open on a machine. Please do let me know if you need any other information.
0
votes
1answer
106 views

find files which are not currently in use

I'm trying to archive some older files, but don't want to touch all the files which are currently in use. What's the best way to ask find to exclude "in use" files? Right now I'm working on this ...
2
votes
2answers
1k views

lsof doesn't show the established TCP connection

On my system, if I run the netstat for a port, it returns: $ netstat -nat | grep "60964" tcp 0 0 192.0.0.1:60964 0.0.0.0:* LISTEN tcp 59 0 192.0.0....
2
votes
1answer
69 views

Is it possible to deterministically trace how port 80 is forwarded and where the configuration is on a given system?

Is there a way to determine or trace how a port forwarding configuration is set up on a system running Ubuntu 14.04 LTS, on which there is a NodeJS service running and somehow accepting connections ...
2
votes
1answer
4k views

Safe to kill a process called *:etlservicemgr (LISTEN)?

I am trying to serve locally to port 9001 but I get an listen EADDRINUSE error. When I look at the port with lsof -i :9001 it shows the following COMMAND PID USER FD TYPE DEVICE ...
2
votes
1answer
355 views

Process has more open sockets than should be allowed by prlimit

Running debian jessie. The following is done as root to avoid any permissions issues. First I find the pid of my program, then I check its open file limit to verify that it is set at 1024. But when I ...
8
votes
3answers
8k views

lsof runs very slow in my server

I'm running lsof in one of my Linux server to check if one file (/tmp/incoming_data.txt) in the ext3 system is opened by other programs. My server has lots of TCP connection on it. The weird thing is ...
-3
votes
1answer
748 views

Display only some of the lines of the lsof command [closed]

I am trying to create a bash script for displaying only certain lines of the lsof command. I have figured out that the lsof command itself lists information in the form of columns which show info ...
0
votes
1answer
501 views

Pipe lsof to grep to awk ps -ef to grep

I'm trying to get some info on a certain PID. I'm probably doing this in a manner that is way too difficult, but I'm trying to run this: lsof | grep grepstuff | awk '{ps -ef | grep $2;}' and I'm not ...
2
votes
1answer
414 views

Regular and repetitive sudo alerts from several Linux hosts

I've got several hosts running CentOS 5.11 on the LAN. Lately we've been getting fairly regular sudo alerts (via email) from attempted sudo commands by non-authorized users. Been Googling in case the ...
1
vote
1answer
48 views

Detect which scripts are using old interpreters

I have a few Debian machines with some nearly-orphaned script interpreters, for example /bin/bash3 and /usr/bin/perl510. How can I detect those scripts that still have the aforementioned interpreters ...
2
votes
1answer
740 views

Incoming FTP transfer not showing in lsof when using specific FTP client

I've got a script that continuously monitors an FTP dropbox directory and processes new files when they come in. The script runs lsof on each file before it tries to process it to determine if the ...
1
vote
2answers
980 views

Can I find the list of ports being listened by a process ordered by the time of opening?

I know I can see the list of open ports using the lsof command. I am trying to view the results ordered by timestamp of listening. The process opens multiple (~6) ports and I suspect the order of ...
0
votes
1answer
1k views

lsof getting ran by root, but not by a user and using high CPU usage

My server is using high CPU usage from lsof, and it appears to be ran randomly and by the root user. I'm finding this out via Newrelic information Is it at all possible to find what is running this ...
0
votes
1answer
870 views

Open file count keeps increasing forever

I'm experiencing issues with the number of files opened increasing over time. If I run my server for about few hours, it'll no more accept any connections. The limit was 1024. I've increased the limit ...
4
votes
3answers
4k views

How to find full process arguments and associated listening ports?

I can execute netstat -atulpn | grep java to find all Java processes with their accompanying ports, which is great, however I would like to also have the processes full execution arguments also shown. ...