Lsof Command Usage

Lsof stands fo list open files and it's a command to be used when you want to investigate "resources" used by a process hence to gain some insight about what that process is actually doing behind the scenes. Through these resources you can also find internet related files such as sockets but I do not recommend to use lsof for this because:

1. ss command is dedicated for this and it is a lot faster

2. when lsof is used it may trigger system logs or even notify in some way the admin of that system

Lsof has many options and I will list the ones which I consider useful but before first I will discuss the columns displayed for a process using -p option. I am using zsh and I have multiple shells running, we will check lsof for one of the zsh processes.

I will pick the first one and use lsof -p ${PID}

Columns COMMAND, PID and USER describe themselves so I will jump to FD column, which stands for open file type. The most popular open file type is a file descriptor (FD) which is sometimes confused with open file. All file descriptors are open files but not all open files are files descriptors!!! I recommend checking file descriptors tutorial.

The last 8 lines of lsof output are files descriptors, they are always represented through a positive integer. Other types of FDs:

• mem - Memory mapped file, usually for share library

• cwd - current working directory

• Lnn - library references (AIX)

• err - FD information error (see NAME column)

• jld - jail directory (FreeBSD)

• ltx - shared library text (code and data)

• Mxx - hex memory-mapped type number xx

• m86 - DOS Merge mapped file

• mem - memory-mapped file

• mmap- memory-mapped device

• DEL - a file which was deleted/changed after it has been opened

• pd - parent directory

• rtd - root directory

• tr - kernel trace file (OpenBSD)

• txt - program text (code and data)

• v86 - VP/ix mapped file

Column TYPE refers to the actual type of file like REG & DIR which have a path on disk, CHR and FIFO which do not have. I mentioned about FD column that it stands also for the type of file but from functionality point of view, like what is the purpose of that file when it comes to the process which opened it. This actual type can be seen easily in the first column from output of ls -l command.

REG - regular file, file that show up in directory - represented by "-" in first column of ls -l output

DIR - directory - represented by "d" in first column of ls -l output

CHR - character file (file living only in memory of OS) - represented by "c" in first column of ls -l output

FIFO - first-in-first-out (named pipes) - represented by "p" in first column of ls -l output. You will find more details about pipes, how to create them and use them in pipes

I need to mention also that you can see two other letters in the first column of ls -l output and those are:

• - "l" for links (hard/soft)

• - "b" for devices which represent NVM memory(storage) - ex: device on which "/" is mounted on

Column DEVICE format differs depending on type of open file as follows:

1) For REG, DIR, CHR and FIFO the device numbers separated by "," will be displayed. I do not know how kernel allocates these numbers but you can use this to find out the file system on which open files are located. We can see the majority have 254, 0 and if we navigate to /dev where all devices are present and ls -lR | grep 254, we will see that the first device is dm-0, which in my case it represents the filesystem mounted on root "/"

So we know that all open files with "254, 0" on DEVICE column have a path on filesystem dm-0 which is mounted on "/". Some of the open files have 136,0 as device numbers and in this case the name which is the actual path of the character file indicates the same file which we will find using device numbers.

We see character file "1" which is in /dev/pts (device/pseudoterminals) and we can see it's whole path also in the output of lsof

2) For open files which have "unix" in the FD column we will see a memory address (8 bytes long). I do not know if the first 4 bytes are displayed as 0x00 because they should remain hidden but in man of lsof it says the following: DEVICE column contains:

• the address of the private data area of a Solaris socket stream

• or a kernel reference address that identifies the file (The kernel reference address may be used for FIFO's, for example.)

• or the base address or device name of a Linux AX.25 socket device

• Usually only the lower thirty two bits of Tru64 UNIX kernel addresses are displayed

As an example, I've ran lsof for firefox (process_ID = 1440) and I've grep-ed output for unix to filter all files with column FD = unix and I've displayed the first 3 lines of output:

That's about it for DEVICE column, as for SIZE/OFFSET column there's not much to know, as stated in lsof manual "is the size of the file or the file offset in bytes. A value is displayed in this column only if it is available". The NODE column refers to the kernel inode ID. This kernel inode table contains all open files in the OS and each open file is associated with an unique NODE ID. Open files which have an actual path on disk and don't live only in RAM can be found by this node id with the find command:

find {path_on_which_file_system_is_mounted_on} -inum {NODE_ID} -print

For more details about i-node please check file descriptors.