lsof 命令详解

原文链接：http://www.javaarch.net/jiagoushi/754.htm

lsof 命令详解

1.查看所有打开的文件列表 
FD列：

	cwd current working directory
	rtd root directory
	txt program text (code and data)
	mem memory-mapped file
	
后面有1u表示：

	r for read access.
	w for write access.
	u for read and write access.
	
TYPE – of files and it’s identification.

	DIR – Directory
	REG – Regular file
	CHR – Character special file.
	FIFO – First In First Out
		

	# lsof

	COMMAND    PID      USER   FD      TYPE     DEVICE  SIZE/OFF       NODE NAME
	init         1      root  cwd      DIR      253,0      4096          2 /
	init         1      root  rtd      DIR      253,0      4096          2 /
	init         1      root  txt      REG      253,0    145180     147164 /sbin/init
	init         1      root  mem      REG      253,0   1889704     190149 /lib/libc-2.12.so
	init         1      root   0u      CHR        1,3       0t0       3764 /dev/null
	init         1      root   1u      CHR        1,3       0t0       3764 /dev/null
	init         1      root   2u      CHR        1,3       0t0       3764 /dev/null
	init         1      root   3r     FIFO        0,8       0t0       8449 pipe
	init         1      root   4w     FIFO       0,8       0t0       8449 pipe
	init         1      root   5r      DIR       0,10         0          1 inotify
	init         1      root   6r      DIR       0,10         0          1 inotify
	init         1      root   7u     unix 0xc1513880       0t0       8450 socket
	
2.查看某个用户打开的文件列表 -u参数

	# lsof -u tecmint

	COMMAND  PID    USER   FD   TYPE     DEVICE SIZE/OFF   NODE NAME
	sshd    1838 tecmint  cwd    DIR      253,0     4096      2 /
	sshd    1838 tecmint  rtd    DIR      253,0     4096      2 /
	sshd    1838 tecmint  txt    REG      253,0   532336 188129 /usr/sbin/sshd
	sshd    1838 tecmint  mem    REG      253,0    19784 190237 /lib/libdl-2.12.so
	sshd    1838 tecmint  mem    REG      253,0   122436 190247 /lib/libselinux.so.1
	sshd    1838 tecmint  mem    REG      253,0   255968 190256 /lib/libgssapi_krb5.so.2.2
	sshd    1838 tecmint  mem    REG      253,0   874580 190255 /lib/libkrb5.so.3.3
	
3.查看某个端口上打开的文件列表 -i参数

	# lsof -i TCP:22

	COMMAND  PID    USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
	sshd    1471    root    3u  IPv4  12683      0t0  TCP *:ssh (LISTEN)
	sshd    1471    root    4u  IPv6  12685      0t0  TCP *:ssh (LISTEN)
	
4.查看ipv4或者ipv6网络文件

	# lsof -i 4

	COMMAND    PID    USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
	rpcbind   1203     rpc    6u  IPv4  11326      0t0  UDP *:sunrpc
	rpcbind   1203     rpc    7u  IPv4  11330      0t0  UDP *:954
	rpcbind   1203     rpc    8u  IPv4  11331      0t0  TCP *:sunrpc (LISTEN)
	avahi-dae 1241   avahi   13u  IPv4  11579      0t0  UDP *:mdns
	avahi-dae 1241   avahi   14u  IPv4  11580      0t0  UDP *:58600

	# lsof -i 6

	COMMAND    PID    USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
	rpcbind   1203     rpc    9u  IPv6  11333      0t0  UDP *:sunrpc
	rpcbind   1203     rpc   10u  IPv6  11335      0t0  UDP *:954
	rpcbind   1203     rpc   11u  IPv6  11336      0t0  TCP *:sunrpc (LISTEN)
	rpc.statd 1277 rpcuser   10u  IPv6  11858      0t0  UDP *:55800
	rpc.statd 1277 rpcuser   11u  IPv6  11862      0t0  TCP *:56428 (LISTEN)
	cupsd     1346    root    6u  IPv6  12112      0t0  TCP localhost:ipp (LISTEN)
	
5.查看某个范围端口上打开的文件列表

	# lsof -i TCP:1-1024

	COMMAND  PID    USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
	rpcbind 1203     rpc   11u  IPv6  11336      0t0  TCP *:sunrpc (LISTEN)
	cupsd   1346    root    7u  IPv4  12113      0t0  TCP localhost:ipp (LISTEN)
	sshd    1471    root    4u  IPv6  12685      0t0  TCP *:ssh (LISTEN)
	master  1551    root   13u  IPv6  12898      0t0  TCP localhost:smtp (LISTEN)
	sshd    1834    root    3r  IPv4  15101      0t0  TCP 192.168.0.2:ssh->192.168.0.1:conclave-cpp (ESTABLISHED)
	sshd    1838 tecmint    3u  IPv4  15101      0t0  TCP 192.168.0.2:ssh->192.168.0.1:conclave-cpp (ESTABLISHED)
	sshd    1871    root    3r  IPv4  15842      0t0  TCP 192.168.0.2:ssh->192.168.0.1:groove (ESTABLISHED)
	httpd   1918    root    5u  IPv6  15991      0t0  TCP *:http (LISTEN)
	httpd   1918    root    7u  IPv6  15995      0t0  TCP *:https (LISTEN)
	
6.除去某个用户

	# lsof -i -u^root

	COMMAND    PID    USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
	rpcbind   1203     rpc    6u  IPv4  11326      0t0  UDP *:sunrpc
	rpcbind   1203     rpc    7u  IPv4  11330      0t0  UDP *:954
	rpcbind   1203     rpc    8u  IPv4  11331      0t0  TCP *:sunrpc (LISTEN)
	rpcbind   1203     rpc    9u  IPv6  11333      0t0  UDP *:sunrpc
	rpcbind   1203     rpc   10u  IPv6  11335      0t0  UDP *:954
	rpcbind   1203     rpc   11u  IPv6  11336      0t0  TCP *:sunrpc (LISTEN)
	avahi-dae 1241   avahi   13u  IPv4  11579      0t0  UDP *:mdns
	avahi-dae 1241   avahi   14u  IPv4  11580      0t0  UDP *:58600
	rpc.statd 1277 rpcuser    5r  IPv4  11836      0t0  UDP *:soap-beep
	rpc.statd 1277 rpcuser    8u  IPv4  11850      0t0  UDP *:55146
	rpc.statd 1277 rpcuser    9u  IPv4  11854      0t0  TCP *:32981 (LISTEN)
	rpc.statd 1277 rpcuser   10u  IPv6  11858      0t0  UDP *:55800
	rpc.statd 1277 rpcuser   11u  IPv6  11862      0t0  TCP *:56428 (LISTEN)
	
7.查看某个用户正在使用的哪些进程打开文件

	# lsof -i -u tecmint

	COMMAND  PID    USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
	bash    1839 tecmint  cwd    DIR  253,0    12288   15 /etc
	ping    2525 tecmint  cwd    DIR  253,0    12288   15 /etc
	
8.查看某个网络连接打开的文件

	# lsof -i

	COMMAND    PID    USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
	rpcbind   1203     rpc    6u  IPv4  11326      0t0  UDP *:sunrpc
	rpcbind   1203     rpc    7u  IPv4  11330      0t0  UDP *:954
	rpcbind   1203     rpc   11u  IPv6  11336      0t0  TCP *:sunrpc (LISTEN)
	avahi-dae 1241   avahi   13u  IPv4  11579      0t0  UDP *:mdns
	avahi-dae 1241   avahi   14u  IPv4  11580      0t0  UDP *:58600
	rpc.statd 1277 rpcuser   11u  IPv6  11862      0t0  TCP *:56428 (LISTEN)
	cupsd     1346    root    6u  IPv6  12112      0t0  TCP localhost:ipp (LISTEN)
	cupsd     1346    root    7u  IPv4  12113      0t0  TCP localhost:ipp (LISTEN)
	sshd      1471    root    3u  IPv4  12683      0t0  TCP *:ssh (LISTEN)
	master    1551    root   12u  IPv4  12896      0t0  TCP localhost:smtp (LISTEN)
	master    1551    root   13u  IPv6  12898      0t0  TCP localhost:smtp (LISTEN)
	sshd      1834    root    3r  IPv4  15101      0t0  TCP 192.168.0.2:ssh->192.168.0.1:conclave-cpp (ESTABLISHED)
	httpd     1918    root    5u  IPv6  15991      0t0  TCP *:http (LISTEN)
	httpd     1918    root    7u  IPv6  15995      0t0  TCP *:https (LISTEN)
	clock-app 2362   narad   21u  IPv4  22591      0t0  TCP 192.168.0.2:45284->www.gov.com:http (CLOSE_WAIT)
	chrome    2377   narad   61u  IPv4  25862      0t0  TCP 192.168.0.2:33358->maa03s04-in-f3.1e100.net:http (ESTABLISHED)
	chrome    2377   narad   80u  IPv4  25866      0t0  TCP 192.168.0.2:36405->bom03s01-in-f15.1e100.net:http (ESTABLISHED)
	
9.查看某个进程打开的文件列表

	# lsof -p 1

	COMMAND PID USER   FD   TYPE     DEVICE SIZE/OFF   NODE NAME
	init      1 root  cwd    DIR      253,0     4096      2 /
	init      1 root  rtd    DIR      253,0     4096      2 /
	init      1 root  txt    REG      253,0   145180 147164 /sbin/init
	init      1 root  mem    REG      253,0  1889704 190149 /lib/libc-2.12.so
	init      1 root  mem    REG      253,0   142472 189970 /lib/ld-2.12.so
	
10.关闭某个用户打开文件的相关进程

	# kill -9 `lsof -t -u tecmint`