2021.07.12 TIL

Description

• “lsof” lists on its standard output file information about files opened by processes for UNIX.

Example

➜  dev lsof +D pine939.github.io
COMMAND    PID      USER   FD   TYPE DEVICE SIZE/OFF    NODE NAME
Code\x20H 1273 kangdasol   33r   REG    1,5       41 8961895 pine939.github.io/.git/refs/remotes/origin/main
com.docke 1576 kangdasol   75r   DIR    1,5     1184 7905573 pine939.github.io

Options

• +D : file information in the specified directory.

  ➜  dev lsof +D pine939.github.io
  COMMAND    PID      USER   FD   TYPE DEVICE SIZE/OFF    NODE NAME
  Code\x20H 1273 kangdasol   33r   REG    1,5       41 8961895 pine939.github.io/.git/refs/remotes/origin/main
  com.docke 1576 kangdasol   75r   DIR    1,5     1184 7905573 pine939.github.io
  

• -c : file information using a specific command

  ➜  dev lsof -c ssh
  COMMAND    PID      USER   FD   TYPE             DEVICE SIZE/OFF                NODE NAME
  ssh-agent 1668 kangdasol  cwd    DIR                1,5      640                   2 /
  ssh-agent 1668 kangdasol  txt    REG                1,5  3578944 1152921500312766607 /usr/bin/ssh-agent
  ssh-agent 1668 kangdasol  txt    REG                1,5  2547760 1152921500312767057 /usr/lib/dyld
  ssh-agent 1668 kangdasol    0r   CHR                3,2      0t0                 317 /dev/null
  ssh-agent 1668 kangdasol    1u   CHR                3,2      0t0                 317 /dev/null
  ssh-agent 1668 kangdasol    2u   CHR                3,2      0t0                 317 /dev/null
  

• -a : when you use multiple options, lsof outputs result by the AND operation.

  lsof -c ssh -a -u kangdasol
  

• -d : based on a given file descriptor.

  ➜  dev lsof -d 0
  COMMAND    PID      USER   FD   TYPE             DEVICE SIZE/OFF NODE NAME
  loginwind  132 kangdasol    0r   CHR                3,2      0t0  317 /dev/null
  distnoted  337 kangdasol    0r   CHR                3,2      0t0  317 /dev/null
  cfprefsd   338 kangdasol    0r   CHR                3,2      0t0  317 /dev/null
  

• -i : find files(processes) using a specific port
  • ex 1) list of files for IPv4

    [shell]# lsof -i 4
    COMMAND     PID    USER   FD   TYPE    DEVICE SIZE/OFF NODE NAME
    rsyslogd    949    root    5u  IPv4     31898      0t0  TCP *:shell (LISTEN)
    

  • ex 2) list of files for IPv6

    [shell]# lsof -i 6
    COMMAND   PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
    rsyslogd  949 root    6u  IPv6  31899      0t0  TCP *:shell (LISTEN)
    

  • ex 3) list of files for TCP

    [shell]# lsof -i TCP
    

  • ex 4) list of files for TCP:22 (using TCP protocol and 22 port)

    [shell]# lsof -i TCP:22
    

• -n : numbered.
• -p : file information used by a specific process.
• -r : monitoring. (default 15 second interval)
• -u : file information opened by a specific user.

  [shell]# lsof -u root
  

Document

• if you want to use other options, read this document