blob: e95b968d56a83a8d864b84adb6e4f4f564b059ea (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
|
```
lsof -p 1111 # show open files for this PID
lsof /path/to/file # show which process has this open
```
A usage in the wild; using lsof to find the qemu process for a specific base image and using that to get instance name and disk path:
```
lsof -F p {{ item['path'] }} | cut -b 2- | head -1 | xargs ps | grep -oP '(instance\\-[a-z0-9]+)|(\\/var\\/lib\\/nova\\/instances\\/[a-z0-9\\-]+\\/disk)' | uniq
```
(man lsof: search "OUTPUT FOR OTHER PROGRAMS")
output for other programs
```
specify -F
These are the fields that lsof will produce. The single character listed first is the field identifier.
a file access mode
c process command name (all characters from proc or
user structure)
C file structure share count
d file's device character code
D file's major/minor device number (0x<hexadecimal>)
f file descriptor (always selected)
F file structure address (0x<hexadecimal>)
G file flaGs (0x<hexadecimal>; names if +fg follows)
g process group ID
i file's inode number
K tasK ID
k link count
l file's lock status
L process login name
m marker between repeated output
M the task comMand name
n file name, comment, Internet address
N node identifier (ox<hexadecimal>
o file's offset (decimal)
p process ID (always selected)
P protocol name
r raw device number (0x<hexadecimal>)
R parent process ID
s file's size (decimal)
S file's stream identification
t file's type
T TCP/TPI information, identified by prefixes (the
`=' is part of the prefix):
QR=<read queue size>
QS=<send queue size>
SO=<socket options and values> (not all dialects)
SS=<socket states> (not all dialects)
ST=<connection state>
TF=<TCP flags and values> (not all dialects)
WR=<window read size> (not all dialects)
WW=<window write size> (not all dialects)
(TCP/TPI information isn't reported for all supported
UNIX dialects. The -h or -? help output for the
-T option will show what TCP/TPI reporting can be
requested.)
u process user ID
z Solaris 10 and higher zone name
Z SELinux security context (inhibited when SELinux is disabled)
0 use NUL field terminator character in place of NL
1-9 dialect-specific field identifiers (The output
of -F? identifies the information to be found
in dialect-specific fields.)
```
|
