LLLLSSSSOOOOFFFF((((8888)))) ((((PPPPUUUUCCCCCCCC)))) LLLLSSSSOOOOFFFF((((8888)))) NNNNAAAAMMMMEEEE lsof - list open files SSSSYYYYNNNNOOOOPPPPSSSSIIIISSSS llllssssooooffff [ ----ddddhhhhllllnnnnNNNNoooossssttttUUUU ] [ ----cccc _c ] [ ----kkkk _k ] [ ----pppp _l ] [ ----uuuu _l ] _n_a_m_e_s DDDDEEEESSSSCCCCRRRRIIIIPPPPTTTTIIIIOOOONNNN _L_s_o_f lists information about files opened by processes for the following operating systems: AIX 3.1.3, 3.1.5, 3.1.7 and 3.2 for the IBM RISC/System 6000 Dynix 3.0.12 and 3.1.2 for the Sequent Symmetry S81 HP-UX 7.x for the Hewlett Packard 9000/300 and 9000/800 HP-UX 8.x for the Hewlett Packard 9000/300, 9000/700 and 9000/800 NeXTStep 2.0 and 2.1 for the NeXT Work Station SunOS 4.1.1 An open file may be a regular file, a directory, a character special file, or a network file (Internet socket, NFS file or Unix domain socket.) A specific file may be selected by its path _n_a_m_e. OOOOPPPPTTTTIIIIOOOONNNNSSSS In the absence of any options, _l_s_o_f lists all open files belonging to all active processes. If any list request option is specified, all other lists must be specifically requested - e.g., if ----nnnn is specified for the listing of Internet network files, NFS files won't be listed unless ----NNNN is also specified; or if a user list is specified with the ----uuuu option, Internet network files and Unix domain socket files belonging to users not in the list won't be listed unless the ----nnnn and ----UUUU options are also specified. ----cccc _c This option specifies a memory (core) file, _c, in place of /dev/kmem or /dev/mem. ----dddd This option selects the production of error messages about unreadable subdirectories of the /_d_e_v directory. Under SunOS, for example, the /_d_e_v/_l_p_d subdirectory is unreadable for security reasons. When building its cache of names and device numbers for devices, _l_s_o_f skips unreadable subdirectories silently unless ----dddd is specified. ----hhhh This option selects a brief usage (help) output list. ----kkkk _k This option specifies a kernel name list file, _k, in place of /vmunix, /mach, /dynix, etc. This Page 1 (printed 4/14/93) LLLLSSSSOOOOFFFF((((8888)))) ((((PPPPUUUUCCCCCCCC)))) LLLLSSSSOOOOFFFF((((8888)))) option is not available under AIX on the IBM RISC/System 6000. ----llll This option inhibits the conversion of user ID numbers to login names. ----nnnn This option selects the listing of Internet network files. ----NNNN This option selects the listing of NFS files. ----oooo This option selects the displaying of the file offset in all cases in place of file size; it causes the SIZE/OFF output column title to be changed to OFFSET. File offsets are normally displayed when they are more meaningful than file size. ----pppp _l This option selects the listing of files for the processes whose ID numbers are in the comma-separated list `l' - e.g., ``123'' or ``123,456''. (There should be no spaces in the list.) ----ssss This option removes the SIZE/OFF or OFFSET column from the output, shortening output lines by eleven characters. ----tttt This option specifies that _l_s_o_f should produce terse output with process identifiers only and no header - e.g., so that the output may be piped to _k_i_l_l(1). ----uuuu _l This option selects the listing of files for the user whose login names or user ID numbers are in the comma-separated list `l' - e.g., ``abe'', or ``548,root''. (There should be no spaces in the list.) ----UUUU This option selects the listing of Unix domain socket files. _n_a_m_e_s These are path names of specific files to list. Symbolic links are resolved before use. If a _n_a_m_e is the mount point of a file system or the device of the mount point of a file system, _l_s_o_f will list all the files open on the file system. If a _n_a_m_e is the base name of a family of multiplexed files - e. g, AIX's /_d_e_v/_p_t_s - _l_s_o_f will list all the associated multipled files on the device that are open - e.g., /_d_e_v/_p_t_s/_1, Page 2 (printed 4/14/93) LLLLSSSSOOOOFFFF((((8888)))) ((((PPPPUUUUCCCCCCCC)))) LLLLSSSSOOOOFFFF((((8888)))) /_d_e_v/_p_t_s/_2, etc. If a _n_a_m_e is none of the above, _l_s_o_f will list any open files whose device and inode match that of the specified path _n_a_m_e. OOOOUUUUTTTTPPPPUUUUTTTT _L_s_o_f lists for each open file: COMMAND contains the first nine characters of the name of the Unix command associated with the process. PID is the Process IDentification number of the process. USER is the user ID number or login name of the user to whom the process belongs. (See the ----llll option.) FD is the File Descriptor number of the file or ``cwd'' if it is the current working directory of the process. FD is followed by one of these characters, describing the mode under which the file is open: rrrr for read access; wwww for write access; uuuu for read and write access; space if unknown (e.g., ``cwd''). The mode character is followed by one of these characters, describing the type of lock applied to the file: rrrr for read lock on part of the file; RRRR for a read lock on the entire file; wwww for a write lock on part of the file; WWWW for a write lock on the entire file; space if there is no lock. TYPE is the type of the vnode associated with the file (see ); or ``inet'' for an Internet domain socket; or ``unix'' for a Unix domain socket. DEVICE contains the major and minor device numbers for a character special, block special, regular, directory or NFS file (an HP-UX minor device number is listed in hexadecimal); Page 3 (printed 4/14/93) LLLLSSSSOOOOFFFF((((8888)))) ((((PPPPUUUUCCCCCCCC)))) LLLLSSSSOOOOFFFF((((8888)))) or the protocol control block address of a Unix or Internet domain file (the number that appears in _n_e_t_s_t_a_t(1)'s ----AAAA output). SIZE/OFF or OFFSET is the size of the file or the file offset in bytes. _L_s_o_f displays whatever value - size or offset - is appropriate for the type of the file. The file size is displayed in decimal; the offset is displayed in hexadecimal (with a leading ``0x''). If the the ----oooo option is specified, _l_s_o_f always displays the file offset and labels the column OFFSET. This column may be inhibited by specifying the ----ssss option. INODE is the inode number of a local file; or the inode number of an NFS file in the server host; or the Internet protocol type - e. g, ``TCP''. NAME is the name of the mount point and file system on which the file resides; or the name of a file specified in the _n_a_m_e_s option (after any symbolic links have been resolved); or the name of a character special or block special device; or the local and remote Internet addresses of a network file; or the address of a Unix domain socket; or the local and remote mount point names of an NFS file. DDDDIIIIAAAAGGGGNNNNOOOOSSSSTTTTIIIICCCCSSSS Errors are identified with messages on the standard error file. _L_s_o_f returns a one (1) if any error was detected, including the failure to locate any _n_a_m_e_s. It returns a zero (0) if no errors were detected and if it was able to list information about all the specified _n_a_m_e_s. EEEEXXXXAAAAMMMMPPPPLLLLEEEESSSS To list all open files, use: Page 4 (printed 4/14/93) LLLLSSSSOOOOFFFF((((8888)))) ((((PPPPUUUUCCCCCCCC)))) LLLLSSSSOOOOFFFF((((8888)))) lsof To list all open Internet and Unix domain files, use: lsof -n -U To list all open files for login name ``abe'', user ID 1234, process 123, process 456 and process 789, use: lsof -p 789,456,123 -u 1234,abe To list all open files on device /dev/hd4, use: lsof /dev/hd4 To find the process that has /u/abe/foo open, use: lsof /u/abe/foo To send a SIGHUP to the processes that have /u/abe/bar open, use: kill -HUP `lsof -t /u/abe/bar` BBBBUUUUGGGGSSSS Since _l_s_o_f reads kernel memory in its search for open files, rapid changes in kernel memory may produce unpredictable results. Absence of hardware or software configurations for some operating systems - e.g., HP-UX 7.x and 8.x and Sequent Dynix 3.1.2 - means that _l_s_o_f has not been fully tested on them. In particular, the use of alternate kernel (with the ----kkkk option) and alternate memory (with the ----cccc option) files has only been tested under SunOS and the Purdue version of Sequent Dynix. Use of an alternate memory file may require a mapping of kernel virtual to physical addresses that _l_s_o_f does not provide. The lock status character (following the file descriptor) is derived under AIX from a test of only the first filock structure of the gnode (see and ). _L_s_o_f can't search for any file by _n_a_m_e unless it is installed with root set-UID permission. Otherwise it is restricted to searching for files to which its user or its set-GID group (if any) have access. _L_s_o_f startup time is long on systems where scanning the /_d_e_v directory is a slow operation. Page 5 (printed 4/14/93) LLLLSSSSOOOOFFFF((((8888)))) ((((PPPPUUUUCCCCCCCC)))) LLLLSSSSOOOOFFFF((((8888)))) Output lines are sometimes greater than eighty characters - e.g., for completed Internet connections or NFS files - causing the output listing to be irregularly spaced. The ----ssss option may be specified to remove the SIZE/OFF of OFFSET column, shortening output lines by eleven characters. If there are files or subdirectories in /_d_e_v that _l_s_o_f can't _s_t_a_t(2) or read, it will ignore them without complaint, unless the ----dddd option is selected. Whether _l_s_o_f complains or not, it is unable to report major and minor device numbers for the entries it can't access. ignores SunOS loop-back mounts. It cannot distinguish between loop-back file systems and real ones, using inode and device numbers. FFFFIIIILLLLEEEESSSS /dev/drum system paging device /dev/kmem kernel virtual memory device /dev/mem physical memory device /dev/swap system paging device AAAAUUUUTTTTHHHHOOOORRRRSSSS _L_s_o_f was written by Victor A. Abell of the Purdue University Computing Center (PUCC), based on the _f_s_t_a_t and _o_f_i_l_e_s programs. He acknowledges his debt to the work of Dan Bernstein, Michael ``Ford'' Ditto, Tom Dunigan, Alexander Dupuy, Vik Lall, Ray Moody, C. Spencer, Michael Spitzer and those who wrote Berkeley's _f_s_t_a_t program, all contributors to _l_s_o_f'_s predecessors. He thanks Doug McKenzie for his HP-UX _p_r_o_c_t_o_r program and Rich Kulawiec for pointing it out. Finally, he is grateful to Mark Bonsack, Jim Cooper, J. Nelson Howell, Markus Lautenbacher, Steve Lacey, Stuart Levy, Wendy Lin, Andreas Luik, Fletcher Mattox, Dale McCluskey, Michael Mackenzie, Dave Stevens, Jeff Stewart and Patrick Wolfe for their help in developing and improving _l_s_o_f. SSSSEEEEEEEE AAAALLLLSSSSOOOO ff(1), fstat(8), fuser(1), kill(1), netstat(1), ofiles(8L), ps(1). Page 6 (printed 4/14/93)