vault backup: 2025-01-13 13:16:06

1 files changed, 69 insertions, 0 deletions

diff --git a/3 resources/linux/LSOF.md b/3 resources/linux/LSOF.md
new file mode 100644
index 0000000..5a3aa95
--- /dev/null
+++ b/3 resources/linux/LSOF.md
@@ -0,0 +1,69 @@
+#linux #how-to 
+
+---
+
+```
+lsof -p 1111 # show open files for this PID
+lsof /path/to/file # show which process has this open
+```
+
+A usage in the wild; using lsof to find the qemu process for a specific base image and using that to get instance name and disk path:
+```
+lsof -F p {{ item['path'] }} | cut -b 2- | head -1 | xargs ps | grep -oP '(instance\\-[a-z0-9]+)|(\\/var\\/lib\\/nova\\/instances\\/[a-z0-9\\-]+\\/disk)' | uniq
+```
+
+(man lsof: search "OUTPUT FOR OTHER PROGRAMS")
+output for other programs
+```
+specify -F
+These are the fields that lsof will produce.  The single character listed first is the field identifier.
+            a    file access mode
+            c    process command name (all characters from proc or
+                 user structure)
+            C    file structure share count
+            d    file's device character code
+            D    file's major/minor device number (0x<hexadecimal>)
+            f    file descriptor (always selected)
+            F    file structure address (0x<hexadecimal>)
+            G    file flaGs (0x<hexadecimal>; names if +fg follows)
+            g    process group ID
+            i    file's inode number
+            K    tasK ID
+            k    link count
+            l    file's lock status
+            L    process login name
+            m    marker between repeated output
+            M    the task comMand name
+            n    file name, comment, Internet address
+            N    node identifier (ox<hexadecimal>
+            o    file's offset (decimal)
+            p    process ID (always selected)
+            P    protocol name
+            r    raw device number (0x<hexadecimal>)
+            R    parent process ID
+            s    file's size (decimal)
+            S    file's stream identification
+            t    file's type
+            T    TCP/TPI information, identified by prefixes (the
+                 `=' is part of the prefix):
+                     QR=<read queue size>
+                     QS=<send queue size>
+                     SO=<socket options and values> (not all dialects)
+                     SS=<socket states> (not all dialects)
+                     ST=<connection state>
+                     TF=<TCP flags and values> (not all dialects)
+                     WR=<window read size>  (not all dialects)
+                     WW=<window write size>  (not all dialects)
+                 (TCP/TPI information isn't reported for all supported
+                   UNIX dialects. The -h or -? help output for the
+                   -T option will show what TCP/TPI reporting can be
+                   requested.)
+            u    process user ID
+            z    Solaris 10 and higher zone name
+            Z    SELinux security context (inhibited when SELinux is disabled)
+            0    use NUL field terminator character in place of NL
+            1-9  dialect-specific field identifiers (The output
+                 of -F? identifies the information to be found
+                 in dialect-specific fields.)
+
+```
\ No newline at end of file