#ifndef lint
static char copyright[] =
"@(#) Copyright 1997 Purdue Research Foundation.\nAll rights reserved.\n";
-static char *rcsid = "$Id: dsock.c,v 1.40 2014/10/13 22:25:58 abe Exp $";
+static char *rcsid = "$Id: dsock.c,v 1.41 2015/07/07 19:46:33 abe Exp $";
#endif
#include <sys/xattr.h>
+#if defined(HASEPTOPTS) && defined(HASUXSOCKEPT)
+/*
+ * UNIX endpoint definitions
+ */
+
+#include <sys/socket.h> /* for AF_NETLINK */
+#include <linux/rtnetlink.h> /* for NETLINK_INET_DIAG */
+#include <linux/sock_diag.h> /* for SOCK_DIAG_BY_FAMILY */
+#include <linux/unix_diag.h> /* for unix_diag_req */
+#include <string.h> /* memset */
+#include <stdint.h> /* for unt8_t */
+#include <unistd.h> /* for getpagesize */
+#define SOCKET_BUFFER_SIZE (getpagesize() < 8192L ? getpagesize() : 8192L)
+#endif /* defined(HASEPTOPTS) && defined(HASUXSOCKEPT) */
+
+
/*
* Local definitions
*/
};
#endif /* defined(HASIPv6) */
-struct uxsin { /* UNIX socket information */
- INODETYPE inode; /* node number */
- char *pcb; /* protocol control block */
- char *path; /* file path */
- unsigned char sb_def; /* stat(2) buffer definitions */
- dev_t sb_dev; /* stat(2) buffer device */
- INODETYPE sb_ino; /* stat(2) buffer node number */
- dev_t sb_rdev; /* stat(2) raw device number */
- uint32_t ty; /* socket type */
- struct uxsin *next;
-};
-
/*
* Local static values
static char *UDPLITEpath = (char *)NULL;
/* path to UDPLITE /proc information */
static char *UNIXpath = (char *)NULL; /* path to UNIX /proc information */
-static struct uxsin **Uxsin = (struct uxsin **)NULL;
+static uxsin_t **Uxsin = (uxsin_t **)NULL;
/* UNIX socket info, hashed by inode */
*/
_PROTOTYPE(static struct ax25sin *check_ax25,(INODETYPE i));
+
+#if defined(HASEPTOPTS) && defined(HASUXSOCKEPT)
+_PROTOTYPE(static void enter_uxsinfo,(uxsin_t *up));
+_PROTOTYPE(static void fill_uxicino,(INODETYPE si, INODETYPE sc));
+_PROTOTYPE(static void fill_uxpino,(INODETYPE si, INODETYPE pi));
+_PROTOTYPE(static int get_diagmsg,(int sockfd));
+_PROTOTYPE(static void get_uxpeeri,(void));
+_PROTOTYPE(static void parse_diag,(struct unix_diag_msg *dm, int len));
+_PROTOTYPE(static void prt_uxs,(uxsin_t *p, int mk));
+#endif /* defined(HASEPTOPTS) && defined(HASUXSOCKEPT) */
+
_PROTOTYPE(static struct icmpin *check_icmp,(INODETYPE i));
_PROTOTYPE(static struct ipxsin *check_ipx,(INODETYPE i));
_PROTOTYPE(static struct nlksin *check_netlink,(INODETYPE i));
_PROTOTYPE(static struct rawsin *check_raw,(INODETYPE i));
_PROTOTYPE(static struct sctpsin *check_sctp,(INODETYPE i));
_PROTOTYPE(static struct tcp_udp *check_tcpudp,(INODETYPE i, char **p));
-_PROTOTYPE(static struct uxsin *check_unix,(INODETYPE i));
+_PROTOTYPE(static uxsin_t *check_unix,(INODETYPE i));
_PROTOTYPE(static void get_ax25,(char *p));
_PROTOTYPE(static void get_icmp,(char *p));
_PROTOTYPE(static void get_ipx,(char *p));
* check_unix() - check for UNIX domain socket
*/
-static struct uxsin *
+static uxsin_t *
check_unix(i)
INODETYPE i; /* socket file's inode number */
{
int h;
- struct uxsin *up;
+ uxsin_t *up;
h = INOHASH(i);
for (up = Uxsin[h]; up; up = up->next) {
if (i == up->inode)
return(up);
}
- return((struct uxsin *)NULL);
+ return((uxsin_t *)NULL);
}
}
(void) fclose(as);
}
+
+
+#if defined(HASEPTOPTS) && defined(HASUXSOCKEPT)
+/*
+ * enter_uxsinfo() -- enter unix socket info
+ * entry Lf = local file structure pointer
+ * Lp = local process structure pointer
+ */
+
+static void
+enter_uxsinfo (up)
+ uxsin_t *up;
+{
+ pxinfo_t *pi; /* pxinfo_t structure pointer */
+ struct lfile *lf; /* local file structure pointer */
+ struct lproc *lp; /* local proc structure pointer */
+ pxinfo_t *np; /* new pxinfo_t structure pointer */
+
+ for (pi = up->pxinfo; pi; pi = pi->next) {
+ lf = pi->lf;
+ lp = &Lproc[pi->lpx];
+ if (pi->ino == Lf->inode) {
+ if ((lp->pid == Lp->pid) && !strcmp(lf->fd, Lf->fd))
+ return;
+ }
+ }
+ if (!(np = (pxinfo_t *)malloc(sizeof(pxinfo_t)))) {
+ (void) fprintf(stderr,
+ "%s: no space for pipeinfo in uxsinfo, PID %d\n",
+ Pn, Lp->pid);
+ Exit(1);
+ }
+ np->ino = Lf->inode;
+ np->lf = Lf;
+ np->lpx = Lp - Lproc;
+ np->next = up->pxinfo;
+ up->pxinfo = np;
+}
+
+
+/*
+ * fill_uxicino() -- fill incoming connection inode number
+ */
+
+static void
+fill_uxicino (si, ic)
+ INODETYPE si; /* UNIX socket inode number */
+ INODETYPE ic; /* incomining UNIX socket connection
+ * inode number */
+{
+ uxsin_t *psi; /* pointer to socket's information */
+ uxsin_t *pic; /* pointer to incoming connection's
+ * information */
+
+ if ((psi = check_unix(si))) {
+ if (psi->icstat || psi->icons)
+ return;
+ if ((pic = check_unix(ic))) {
+ psi->icstat = 1;
+ psi->icons = pic;
+ }
+ }
+}
+
+
+/*
+ * fill_uxpino() -- fill in UNIX socket's peer inode number
+ */
+
+static void
+fill_uxpino(si, pi)
+ INODETYPE si; /* UNIX socket inode number */
+ INODETYPE pi; /* UNIX socket peer's inode number */
+{
+ uxsin_t *pp, *up;
+
+ if ((up = check_unix(si))) {
+ if (!up->peer) {
+ if (pp = check_unix(pi))
+ up->peer = pp;
+ }
+ }
+}
+
+
+/*
+ * find_uxepti(lf) -- find UNIX socket endpoint info
+ */
+
+uxsin_t *
+find_uxepti(lf)
+ struct lfile *lf; /* pipe's lfile */
+{
+ uxsin_t *up;
+
+ up = check_unix(lf->inode);
+ return(up ? up->peer: (uxsin_t *)NULL);
+}
+
+
+/*
+ * get_diagmsg() -- get UNIX socket's diag message
+ */
+
+static int
+get_diagmsg(sockfd)
+ int sockfd; /* socket's file descriptor */
+{
+ struct msghdr msg; /* message header */
+ struct nlmsghdr nlh; /* header length */
+ struct unix_diag_req creq; /* connection request */
+ struct sockaddr_nl sa; /* netlink socket address */
+ struct iovec iov[2]; /* I/O vector */
+/*
+ * Build and send message to socket's file descriptor, asking for its
+ * diagnostic message.
+ */
+ zeromem((char *)&msg, sizeof(msg));
+ zeromem((char *)&sa, sizeof(sa));
+ zeromem((char *)&nlh, sizeof(nlh));
+ zeromem((char *)&creq, sizeof(creq));
+ sa.nl_family = AF_NETLINK;
+ creq.sdiag_family = AF_UNIX;
+ creq.sdiag_protocol = 0;
+ memset((void *)&creq.udiag_states, -1, sizeof(creq.udiag_states));
+ creq.udiag_ino = (INODETYPE)0;
+ creq.udiag_show = UDIAG_SHOW_PEER|UDIAG_SHOW_ICONS;
+ nlh.nlmsg_len = NLMSG_LENGTH(sizeof(creq));
+ nlh.nlmsg_flags = NLM_F_DUMP | NLM_F_REQUEST;
+ nlh.nlmsg_type = SOCK_DIAG_BY_FAMILY;
+ iov[0].iov_base = (void *)&nlh;
+ iov[0].iov_len = sizeof(nlh);
+ iov[1].iov_base = (void *) &creq;
+ iov[1].iov_len = sizeof(creq);
+ msg.msg_name = (void *) &sa;
+ msg.msg_namelen = sizeof(sa);
+ msg.msg_iov = iov;
+ msg.msg_iovlen = 2;
+ return(sendmsg(sockfd, &msg, 0));
+}
+
+
+/*
+ * get_uxpeeri() - get UNIX socket peer inode information
+ */
+
+static void
+get_uxpeeri()
+{
+ struct unix_diag_msg *dm; /* pointer to diag message */
+ struct nlmsghdr *hp; /* netlink structure header pointer */
+ int nb = 0; /* number of bytes */
+ int ns = 0; /* netlink socket */
+ uint8_t rb[SOCKET_BUFFER_SIZE]; /* receive buffer */
+ int rl = 0; /* route info length */
+/*
+ * Get a netlink socket.
+ */
+ if ((ns = socket(AF_NETLINK, SOCK_DGRAM, NETLINK_SOCK_DIAG)) == -1) {
+ (void) fprintf(stderr, "%s: netlink socket error: %s\n",
+ Pn, strerror(errno));
+ Exit(1);
+ }
+/*
+ * Request peer information.
+ */
+ if (get_diagmsg(ns) < 0) {
+ (void) fprintf(stderr, "%s: netlink peer request error: %s\n",
+ Pn, strerror(errno));
+ goto get_uxpeeri_exit;
+ }
+/*
+ * Receive peer information.
+ */
+ while (1) {
+ if ((nb = recv(ns, rb, sizeof(rb), 0)) <= 0)
+ goto get_uxpeeri_exit;
+ hp = (struct nlmsghdr *)rb;
+ while (NLMSG_OK(hp, nb)) {
+ if(hp->nlmsg_type == NLMSG_DONE)
+ goto get_uxpeeri_exit;
+ if(hp->nlmsg_type == NLMSG_ERROR) {
+ (void) fprintf(stderr,
+ "%s: netlink UNIX socket msg peer info error\n", Pn);
+ goto get_uxpeeri_exit;
+ }
+ dm = (struct unix_diag_msg *)NLMSG_DATA(hp);
+ rl = hp->nlmsg_len - NLMSG_LENGTH(sizeof(*dm));
+ parse_diag(dm, rl);
+ hp = NLMSG_NEXT(hp, nb);
+ }
+ }
+
+get_uxpeeri_exit:
+
+ (void) close(ns);
+}
+
+
+/*
+ * parse_diag() -- parse UNIX diag message
+ */
+
+static void
+parse_diag(dm, len)
+ struct unix_diag_msg *dm; /* pointer to diag message */
+ int len; /* message length */
+{
+ struct rtattr *rp; /* route info pointer */
+ int i; /* tmporary index */
+ int icct; /* incoming connection count */
+ uint32_t *icp; /* incoming connection pointer */
+ uint32_t inoc, inop; /* inode numbers */
+
+ if (!dm || (dm->udiag_family != AF_UNIX) || !(inop = dm->udiag_ino)
+ || (len <= 0)
+ ) {
+ return;
+ }
+ rp = (struct rtattr *)(dm + 1);
+/*
+ * Process route information.
+ */
+ while (RTA_OK(rp, len)) {
+ switch (rp->rta_type) {
+ case UNIX_DIAG_PEER:
+ if (len < 4) {
+ (void) fprintf(stderr,
+ "%s: unix_diag: msg length (%d) < 4)\n", Pn, len);
+ return;
+ }
+ if ((inoc = *(uint32_t *)RTA_DATA(rp))) {
+ fill_uxpino((INODETYPE)inop, (INODETYPE)inoc);
+ fill_uxpino((INODETYPE)inoc, (INODETYPE)inop);
+ }
+ break;
+ case UNIX_DIAG_ICONS:
+ icct = RTA_PAYLOAD(rp),
+ icp = (uint32_t *)RTA_DATA(rp);
+
+ for (i = 0; i < icct; i += sizeof(uint32_t), icp++) {
+ fill_uxicino((INODETYPE)inop, (INODETYPE)*icp);
+ }
+ }
+ rp = RTA_NEXT(rp, len);
+ }
+}
+
+
+/*
+ * prt_uxs() -- print UNIX socket information
+ */
+
+static void
+prt_uxs(p, mk)
+ uxsin_t *p; /* peer info */
+ int mk; /* 1 == mark for later processing */
+{
+ struct lproc *ep; /* socket endpoint process */
+ struct lfile *ef; /* socket endpoint file */
+ int i; /* temporary index */
+ int len; /* string length */
+ char nma[1024]; /* character buffer */
+ pxinfo_t *pp; /* previous pipe info of socket */
+
+ (void) strcpy(nma, "->INO=");
+ len = (int)strlen(nma);
+ (void) snpf(&nma[len], sizeof(nma) - len - 1, InodeFmt_d, p->inode);
+ (void) add_nma(nma, strlen(nma));
+ for (pp = p->pxinfo; pp; pp = pp->next) {
+
+ /*
+ * Add a linked socket's PID, command name and FD to the name column
+ * addition.
+ */
+ ep = &Lproc[pp->lpx];
+ ef = pp->lf;
+ for (i = 0; i < (FDLEN - 1); i++) {
+ if (ef->fd[i] != ' ')
+ break;
+ }
+ (void) snpf(nma, sizeof(nma) - 1, "%d,%.*s,%s%c",
+ ep->pid, CmdLim, ep->cmd, &ef->fd[i], ef->access);
+ (void) add_nma(nma, strlen(nma));
+ if (mk && FeptE == 2) {
+
+ /*
+ * Endpoint files have been selected, so mark this
+ * one for selection later.
+ */
+ ef->chend = CHEND_UXS;
+ ep->ept |= EPT_UXS_END;
+ }
+ }
+}
+
+
+/*
+ * process_uxsinfo() -- process UNIX socket information, adding it to selected
+ * UNIX socket files and selecting UNIX socket end point
+ * files (if requested)
+ */
+
+void
+process_uxsinfo(f)
+ int f; /* function:
+ * 0 == process selected socket
+ * 1 == process socket end point
+ */
+{
+ uxsin_t *p; /* peer UNIX socket info pointer */
+ uxsin_t *tp; /* temporary UNIX socket info pointer */
+
+ if (!FeptE)
+ return;
+ for (Lf = Lp->file; Lf; Lf = Lf->next) {
+ if (strcmp(Lf->type, "unix"))
+ continue;
+ switch (f) {
+ case 0:
+
+ /*
+ * Process already selected socket.
+ */
+ if (is_file_sel(Lp, Lf)) {
+
+ /*
+ * This file has been selected by some criterion other than its
+ * being a socket. Look up the socket's endpoints.
+ */
+ p = find_uxepti(Lf);
+ if (p && p->inode)
+ prt_uxs(p, 1);
+ if ((tp = check_unix(Lf->inode))) {
+ if (tp->icons) {
+ if (tp->icstat) {
+ p = tp->icons;
+ while (p != tp) {
+ if (p && p->inode)
+ prt_uxs(p, 1);
+ p = p->icons;
+ }
+ } else {
+ for (p = tp->icons; !p->icstat; p = p->icons)
+ ; /* DO NOTHING */
+ if (p->icstat && p->inode)
+ prt_uxs (p, 1);
+ }
+ }
+ }
+ }
+ break;
+ case 1:
+ if (!is_file_sel(Lp, Lf) && (Lf->chend & CHEND_UXS)) {
+
+ /*
+ * This is an unselected end point UNIX socket file. Select it
+ * and add its end point information to peer's name column
+ * addition.
+ */
+ Lf->sf = Selflags;
+ Lp->pss |= PS_SEC;
+ p = find_uxepti(Lf);
+ if (p && p->inode)
+ prt_uxs(p, 0);
+ else if ((tp = check_unix(Lf->inode))) {
+ if (tp->icons) {
+ if (tp->icstat) {
+ p = tp->icons;
+ while (p != tp) {
+ if (p && p->inode)
+ prt_uxs(p, 0);
+ p = p->icons;
+ }
+ } else {
+ for (p = tp->icons; !p->icstat; p = p->icons)
+ ; /* DO NOTHING */
+ if (p->icstat && p->inode)
+ prt_uxs(p, 0);
+ }
+ }
+ }
+ }
+ break;
+ }
+ }
+}
+#endif /* defined(HASEPTOPTS) && defined(HASUXSOCKEPT) */
/*
int h;
INODETYPE inode;
struct icmpin *np, *icmpp;
- unsigned long pr;
- MALLOC_S lal, ral, spl;
+ MALLOC_S lal, ral;
static char *vbuf = (char *)NULL;
static size_t vsz = (size_t)0;
FILE *xs;
*/
TcpUdp_bucks = INOBUCKS;
if ((fs = fopen(SockStatPath, "r"))) {
- while(fgets(buf, sizeof(buf) - 1, fs)) {
+ while (fgets(buf, sizeof(buf) - 1, fs)) {
if (get_fields(buf, (char *)NULL, &fp, (int *)NULL, 0) != 3)
continue;
if (!fp[0] || strcmp(fp[0], "sockets:")
if (!(fs = open_proc_stream(p, "r", &vbuf, &vsz, 0)))
return;
nf = 12;
- while(fgets(buf, sizeof(buf) - 1, fs)) {
+ while (fgets(buf, sizeof(buf) - 1, fs)) {
if (get_fields(buf,
(nf == 12) ? (char *)NULL : ":",
&fp, (int *)NULL, 0)
TcpUdp6_bucks = INOBUCKS;
h = i = nf = 0;
if ((fs = fopen(SockStatPath6, "r"))) {
- while(fgets(buf, sizeof(buf) - 1, fs)) {
+ while (fgets(buf, sizeof(buf) - 1, fs)) {
if (get_fields(buf, (char *)NULL, &fp, (int *)NULL, 0) != 3)
continue;
if (!fp[0]
if (!(fs = open_proc_stream(p, "r", &vbuf, &vsz, 0)))
return;
nf = 12;
- while(fgets(buf, sizeof(buf) - 1, fs)) {
+ while (fgets(buf, sizeof(buf) - 1, fs)) {
if (get_fields(buf,
(nf == 12) ? (char *)NULL : ":",
&fp, (int *)NULL, 0)
int h, nf;
INODETYPE inode;
MALLOC_S len;
- struct uxsin *np, *up;
+ uxsin_t *np, *up;
FILE *us;
uint32_t ty;
static char *vbuf = (char *)NULL;
static size_t vsz = (size_t)0;
+
+#if defined(HASEPTOPTS) && defined(HASUXSOCKEPT)
+ pxinfo_t *pp, *pnp;
+#endif /* defined(HASEPTOPTS) && defined(HASUXSOCKEPT) */
+
/*
* Do second time cleanup or first time setup.
*/
for (h = 0; h < INOBUCKS; h++) {
for (up = Uxsin[h]; up; up = np) {
np = up->next;
+
+#if defined(HASEPTOPTS) && defined(HASUXSOCKEPT)
+ for (pp = up->pxinfo; pp; pp = pnp) {
+ pnp = pp->next;
+ (void) free((FREE_P *)pp);
+ }
+#endif /* defined(HASEPTOPTS) && defined(HASUXSOCKEPT) */
+
if (up->path)
(void) free((FREE_P *)up->path);
if (up->pcb)
(void) free((FREE_P *)up->pcb);
(void) free((FREE_P *)up);
}
- Uxsin[h] = (struct uxsin *)NULL;
+ Uxsin[h] = (uxsin_t *)NULL;
}
} else {
- Uxsin = (struct uxsin **)calloc(INOBUCKS, sizeof(struct uxsin *));
+ Uxsin = (uxsin_t **)calloc(INOBUCKS, sizeof(uxsin_t *));
if (!Uxsin) {
(void) fprintf(stderr,
"%s: can't allocate %d bytes for Unix socket info\n",
- Pn, (int)(INOBUCKS * sizeof(struct uxsin *)));
+ Pn, (int)(INOBUCKS * sizeof(uxsin_t *)));
}
}
/*
* Allocate and fill a Unix socket info structure; link it to its
* hash bucket.
*/
- if (!(up = (struct uxsin *)malloc(sizeof(struct uxsin)))) {
+ if (!(up = (uxsin_t *)malloc(sizeof(uxsin_t)))) {
(void) fprintf(stderr,
"%s: can't allocate %d bytes for uxsin struct\n",
- Pn, (int)sizeof(struct uxsin));
+ Pn, (int)sizeof(uxsin_t));
Exit(1);
}
up->inode = inode;
+ up->next = (uxsin_t *)NULL;
up->pcb = pcb;
up->sb_def = 0;
up->ty = ty;
up->sb_rdev = sb.st_rdev;
}
}
+
+#if defined(HASEPTOPTS) && defined(HASUXSOCKEPT)
+ /*
+ * Clean UNIX socket endpoint values.
+ */
+ up->icstat = 0;
+ up->pxinfo = (pxinfo_t *)NULL;
+ up->peer = up->icons = (uxsin_t *)NULL;
+#endif /* defined(HASEPTOPTS) && defined(HASUXSOCKEPT) */
+
up->next = Uxsin[h];
Uxsin[h] = up;
}
+
+#if defined(HASEPTOPTS) && defined(HASUXSOCKEPT)
+/*
+ * If endpoint info has been requested, get UNIX socket peer info.
+ */
+ if (FeptE)
+ get_uxpeeri();
+#endif /* defined(HASEPTOPTS) && defined(HASUXSOCKEPT) */
+
(void) fclose(us);
}
int lss; /* *l status -- i.e, SB_* values */
{
struct ax25sin *ap;
- char *cp, *path, tbuf[64];
+ char *cp, *path = (char *)NULL, tbuf[64];
unsigned char *fa, *la;
struct in_addr fs, ls;
struct icmpin *icmpp;
struct sctpsin *sp;
static ssize_t sz;
struct tcp_udp *tp;
- struct uxsin *up;
+ uxsin_t *up;
#if defined(HASIPv6)
int af;
Lf->inode = (INODETYPE)s->st_ino;
Lf->inp_ty = 1;
}
+
+#if defined(HASEPTOPTS) && defined(HASUXSOCKEPT)
+ if (FeptE) {
+ (void) enter_uxsinfo(up);
+ Lf->sf |= SELUXSINFO;
+ }
+#endif /* defined(HASEPTOPTS) && defined(HASUXSOCKEPT) */
+
cp = sockty2str(up->ty, &rf);
(void) snpf(Namech, Namechl - 1, "%s%stype=%s",
up->path ? up->path : "",
* If the file has not yet been found and the stat buffer has
* st_mode, search for the file by full path.
*/
- if (is_file_named(2, path, (struct mounts *)NULL,
+ if (is_file_named(2, up->path ? up->path : p,
+ (struct mounts *)NULL,
((s->st_mode & S_IFMT) == S_IFCHR)) ? 1 : 0)
{
Lf->sf |= SELNM;
[ -z [z] ] [ -Z [Z] ] [ -- ] [names]
DESCRIPTION
- Lsof revision 4.88 lists on its standard output file infor-
+ Lsof revision 4.89 lists on its standard output file infor-
mation about files opened by processes for the following
UNIX dialects:
-SunOS 5.9 Last change: Revision-4.88 1
+SunOS 5.9 Last change: Revision-4.89 1
-SunOS 5.9 Last change: Revision-4.88 2
+SunOS 5.9 Last change: Revision-4.89 2
-SunOS 5.9 Last change: Revision-4.88 3
+SunOS 5.9 Last change: Revision-4.89 3
-SunOS 5.9 Last change: Revision-4.88 4
+SunOS 5.9 Last change: Revision-4.89 4
-SunOS 5.9 Last change: Revision-4.88 5
+SunOS 5.9 Last change: Revision-4.89 5
-SunOS 5.9 Last change: Revision-4.88 6
+SunOS 5.9 Last change: Revision-4.89 6
-SunOS 5.9 Last change: Revision-4.88 7
+SunOS 5.9 Last change: Revision-4.89 7
information might be made available via the +|-m m
option.)
- +|-E +E specifies that Linux files should be displayed
- with endpoint information and the files of the end-
- points should also be displayed.
-
- Endpoint information is displayed in the NAME
- column in the form ``PID,cmd,FDmode''. PID is the
- endpoint process ID; cmd is the endpoint process
- command; FD is the endpoint file's descriptor; and
- mode is the endpoint file's access mode. Multiple
- occurrences of this information can appear in a
- file's NAME column.
-
- -E specfies that Linux pipe files should only be
- displayed with endpoint information.
+ +|-E +E specifies that Linux pipe and Linux UNIX socket
+ files should be displayed with endpoint information
+ and the files of the endpoints should also be
+ displayed. Note: UNIX socket file endpoint infor-
+ mation is available only when the compile flags
+ line of -v output contains HASUXSOCKEPT.
+
+ Pipe endpoint information is displayed in the NAME
+ column in the form ``PID,cmd,FDmode'', where PID is
+ the endpoint process ID; cmd is the endpoint pro-
+ cess command; FD is the endpoint file's descriptor;
+ and mode is the endpoint file's access mode.
+
+ UNIX socket file endpoint information is displayed
+ in the NAME column in the form
+ ``type=TYPE ->INO=INODE PID,cmd,FDmode'', where
+ TYPE is the socket type; INODE is the i-node number
+ of the connected socket; and PID, cmd, FD, and mode
+ are the same as with pipe endpoint information.
+ Note: UNIX socket file endpoint information is
+ available only when the compile flags line of -v
+ output contains HASUXSOCKEPT.
+
+ Multiple occurrences of this information can appear
+ in a file's NAME column.
+
+ -E specfies that Linux pipe and Linux UNIX socket
+ files should be displayed with endpoint informa-
+ tion, but not the files of the endpoints.
+|-f [cfgGn]
f by itself clarifies how path name arguments are
to be interpreted. When followed by c, f, g, G, or
n in any combination it specifies that the listing
- of kernel file structure information is to be
- enabled (`+') or inhibited (`-').
- Normally a path name argument is taken to be a file
- system name if it matches a mounted-on directory
- name reported by mount(8), or if it represents a
- block device, named in the mount output and associ-
- ated with a mounted directory name. When +f is
- specified, all path name arguments will be taken to
- be file system names, and lsof will complain if any
- are not. This can be useful, for example, when the
- file system name (mounted-on device) isn't a block
- device. This happens for some CD-ROM file systems.
- When -f is specified by itself, all path name
+SunOS 5.9 Last change: Revision-4.89 8
-SunOS 5.9 Last change: Revision-4.88 8
+Maintenance Procedures LSOF(8)
-Maintenance Procedures LSOF(8)
+ of kernel file structure information is to be
+ enabled (`+') or inhibited (`-').
+ Normally a path name argument is taken to be a file
+ system name if it matches a mounted-on directory
+ name reported by mount(8), or if it represents a
+ block device, named in the mount output and associ-
+ ated with a mounted directory name. When +f is
+ specified, all path name arguments will be taken to
+ be file system names, and lsof will complain if any
+ are not. This can be useful, for example, when the
+ file system name (mounted-on device) isn't a block
+ device. This happens for some CD-ROM file systems.
- arguments will be taken to be simple files. Thus,
- for example, the ``-f -- /'' arguments direct lsof
- to search for open files with a `/' path name, not
- all open files in the `/' (root) file system.
+ When -f is specified by itself, all path name argu-
+ ments will be taken to be simple files. Thus, for
+ example, the ``-f -- /'' arguments direct lsof to
+ search for open files with a `/' path name, not all
+ open files in the `/' (root) file system.
Be careful to make sure +f and -f are properly ter-
minated and aren't followed by a character (e.g.,
node addresses may be used to detect more readily
identical files inherited by child processes and
identical files in use by different processes.
+
+
+
+SunOS 5.9 Last change: Revision-4.89 9
+
+
+
+
+
+
+Maintenance Procedures LSOF(8)
+
+
+
Lsof column output can be sorted by output columns
holding the values and listed to identify identical
file use, or lsof field output can be parsed by an
description of the field identification characters
and the field output process.
-
-
-
-SunOS 5.9 Last change: Revision-4.88 9
-
-
-
-
-
-
-Maintenance Procedures LSOF(8)
-
-
-
When the field selection character list is empty,
all standard fields are selected (except the raw
device field, security context and zone field for
represent exclusions.
Multiple PGID numbers are joined in a single ORed
- set before participating in AND option selection.
- However, PGID exclusions are applied without ORing
- or ANDing and take effect before other selection
- criteria are applied.
- The -g option also enables the output display of
- PGID numbers. When specified without a PGID set
- that's all it does.
- -i [i] selects the listing of files any of whose Internet
- address matches the address specified in i. If no
- address is specified, this option selects the list-
- ing of all Internet and x.25 (HP-UX) network files.
- If -i4 or -i6 is specified with no following
+SunOS 5.9 Last change: Revision-4.89 10
-SunOS 5.9 Last change: Revision-4.88 10
+Maintenance Procedures LSOF(8)
-Maintenance Procedures LSOF(8)
+ set before participating in AND option selection.
+ However, PGID exclusions are applied without ORing
+ or ANDing and take effect before other selection
+ criteria are applied.
+ The -g option also enables the output display of
+ PGID numbers. When specified without a PGID set
+ that's all it does.
+ -i [i] selects the listing of files any of whose Internet
+ address matches the address specified in i. If no
+ address is specified, this option selects the list-
+ ing of all Internet and x.25 (HP-UX) network files.
+ If -i4 or -i6 is specified with no following
address, only files of the indicated IP version,
IPv4 or IPv6, are displayed. (An IPv6 specifica-
tion may be used only if the dialects supports
An Internet address is specified in the form (Items
in square brackets are optional.):
- [46][protocol][@hostname|hostaddr][:service|port]
+ [46][protocol][@hostname|hostaddr][:service|port]
where:
46 specifies the IP version, IPv4 or IPv6
colon form, enclosed in brackets, if the
UNIX dialect supports IPv6. When an IP
version is selected, only its numeric
+
+
+
+SunOS 5.9 Last change: Revision-4.89 11
+
+
+
+
+
+
+Maintenance Procedures LSOF(8)
+
+
+
addresses may be specified.
service is an /etc/services name - e.g., smtp -
or a list of them.
IPv4 host names and addresses may not be specified
if network file selection is limited to IPv6 with
-i 6. IPv6 host names and addresses may not be
-
-
-
-SunOS 5.9 Last change: Revision-4.88 11
-
-
-
-
-
-
-Maintenance Procedures LSOF(8)
-
-
-
specified if network file selection is limited to
IPv4 with -i 4. When an open IPv4 network file's
address is mapped in an IPv6 address, the open
UDP:who - UDP who service port
TCP@lsof.itap:513 - TCP, port 513 and host name lsof.itap
tcp@foo:1-10,smtp,99 - TCP, ports 1 through 10,
+
+
+
+SunOS 5.9 Last change: Revision-4.89 12
+
+
+
+
+
+
+Maintenance Procedures LSOF(8)
+
+
+
service name smtp, port 99, host name foo
tcp@bar:1-smtp - TCP, ports 1 through smtp, host bar
:time - either TCP, UDP or UDPLITE time service port
tasks of a main process are selected by other
options, the main process will also be listed as
though it were a task, but without a task ID. (See
-
-
-
-SunOS 5.9 Last change: Revision-4.88 12
-
-
-
-
-
-
-Maintenance Procedures LSOF(8)
-
-
-
the description of the TID column in the OUTPUT
section.)
files on the specified file system.
For other link count comparisons, use field output
- (-F) and a post-processing script or program.
- +|-m m specifies an alternate kernel memory file or
- activates mount table supplement processing.
- The option form -m m specifies a kernel memory
- file, m, in place of /dev/kmem or /dev/mem - e.g.,
- a crash dump file.
- The option form +m requests that a mount supplement
- file be written to the standard output file. All
- other options are silently ignored.
+SunOS 5.9 Last change: Revision-4.89 13
- There will be a line in the mount supplement file
- for each mounted file system, containing the
-SunOS 5.9 Last change: Revision-4.88 13
+Maintenance Procedures LSOF(8)
+ (-F) and a post-processing script or program.
-Maintenance Procedures LSOF(8)
+ +|-m m specifies an alternate kernel memory file or
+ activates mount table supplement processing.
+ The option form -m m specifies a kernel memory
+ file, m, in place of /dev/kmem or /dev/mem - e.g.,
+ a crash dump file.
+ The option form +m requests that a mount supplement
+ file be written to the standard output file. All
+ other options are silently ignored.
+ There will be a line in the mount supplement file
+ for each mounted file system, containing the
mounted file system directory, followed by a single
space, followed by the device number in hexadecimal
"0x" format - e.g.,
ports, where port mapping is supported. (See the
last paragraph of this option description for
information about where portmapper registration
- reporting is suported.)
+ reporting is supported.)
The default reporting mode is set by the lsof
builder with the HASPMAPENABLED #define in the
or enabling it when already enabled is acceptable.
When portmapper registration reporting is enabled,
lsof displays the portmapper registration (if any)
+
+
+
+SunOS 5.9 Last change: Revision-4.89 14
+
+
+
+
+
+
+Maintenance Procedures LSOF(8)
+
+
+
for local TCP, UDP or UDPLITE ports in square
brackets immediately following the port numbers or
service names - e.g., ``:1234[name]'' or
determine if portmapper registration reporting is
slowing or blocking lsof.
-
-
-
-SunOS 5.9 Last change: Revision-4.88 14
-
-
-
-
-
-
-Maintenance Procedures LSOF(8)
-
-
-
For purposes of portmapper registration reporting
lsof considers a TCP, UDP or UDPLITE port local if:
it is found in the local part of its containing
changed to OFFSET. Note: on some UNIX dialects
lsof can't obtain accurate or consistent file
offset information from its kernel data sources,
+
+
+
+SunOS 5.9 Last change: Revision-4.89 15
+
+
+
+
+
+
+Maintenance Procedures LSOF(8)
+
+
+
sometimes just for particular kinds of files (e.g.,
socket files.) Consult the lsof FAQ (The FAQ sec-
tion gives its location.) for more information.
zero (unlimited) directs lsof to use the ``0t''
form for all offset output.
-
-
-SunOS 5.9 Last change: Revision-4.88 15
-
-
-
-
-
-
-Maintenance Procedures LSOF(8)
-
-
-
This option does NOT direct lsof to display offset
at all times; specify -o (without a trailing
number) to do that. -o o only specifies the number
e.g., ``123'' or ``123,^456''. (There should be no
spaces in the set.)
+
+
+SunOS 5.9 Last change: Revision-4.89 16
+
+
+
+
+
+
+Maintenance Procedures LSOF(8)
+
+
+
PID numbers that begin with `^' (negation)
represent exclusions.
ful when port name lookup is not working properly.
+|-r [t[m<fmt>]]
-
-
-
-SunOS 5.9 Last change: Revision-4.88 16
-
-
-
-
-
-
-Maintenance Procedures LSOF(8)
-
-
-
puts lsof in repeat mode. There lsof lists open
files as selected by other options, delays t
seconds (default fifteen), then repeats the list-
format, ``%n''. Note also that when <fmt> contains
spaces or other characters that affect the shell's
interpretation of arguments, <fmt> must be quoted
- appropriately.
- Repeat mode reduces lsof startup overhead, so it is
- more efficient to use this mode than to call lsof
- repetitively from a shell script, for example.
- To use repeat mode most efficiently, accompany +|-r
- with specification of other lsof selection options,
- so the amount of kernel memory access lsof does
- will be kept to a minimum. Options that filter at
- the process level - e.g., -c, -g, -p, -u - are the
- most efficient selectors.
- Repeat mode is useful when coupled with field out-
- put (see the -F, option description) and a
+SunOS 5.9 Last change: Revision-4.89 17
-SunOS 5.9 Last change: Revision-4.88 17
+Maintenance Procedures LSOF(8)
-Maintenance Procedures LSOF(8)
+ appropriately.
+ Repeat mode reduces lsof startup overhead, so it is
+ more efficient to use this mode than to call lsof
+ repetitively from a shell script, for example.
+ To use repeat mode most efficiently, accompany +|-r
+ with specification of other lsof selection options,
+ so the amount of kernel memory access lsof does
+ will be kept to a minimum. Options that filter at
+ the process level - e.g., -c, -g, -p, -u - are the
+ most efficient selectors.
+ Repeat mode is useful when coupled with field out-
+ put (see the -F, option description) and a
supervising awk or Perl script, or a C program.
-R directs lsof to list the Parent Process IDentifica-
trolled by the specified exclusions and inclusions,
the -i option must be specified, too. If only a
single protocol's files are to be listed, add its
- name as an argument to the -i option.
- For example, to list only network files with TCP
- state LISTEN, use:
- -iTCP -sTCP:LISTEN
+SunOS 5.9 Last change: Revision-4.89 18
- Or, for example, to list network files with all UDP
- states except Idle, use:
- -iUDP -sUDP:Idle
- State names vary with UNIX dialects, so it's not
+Maintenance Procedures LSOF(8)
-SunOS 5.9 Last change: Revision-4.88 18
+ name as an argument to the -i option.
+ For example, to list only network files with TCP
+ state LISTEN, use:
+ -iTCP -sTCP:LISTEN
-Maintenance Procedures LSOF(8)
+ Or, for example, to list network files with all UDP
+ states except Idle, use:
+ -iUDP -sUDP:Idle
+ State names vary with UNIX dialects, so it's not
possible to provide a complete list. Some common
TCP state names are: CLOSED, IDLE, BOUND, LISTEN,
ESTABLISHED, SYN_SENT, SYN_RCDV, ESTABLISHED,
addresses. In normal output the information
appears in parentheses, each item except TCP or TPI
state name identified by a keyword, followed by
+
+
+
+SunOS 5.9 Last change: Revision-4.89 19
+
+
+
+
+
+
+Maintenance Procedures LSOF(8)
+
+
+
`=', separated from others by a single space:
Items values (when available) are reported after
the item name and '='.
-
-
-SunOS 5.9 Last change: Revision-4.88 19
-
-
-
-
-
-
-Maintenance Procedures LSOF(8)
-
-
-
When the field output mode is in effect (See OUTPUT
FOR OTHER PROGRAMS.) each item appears as a field
with a `T' leading character.
TCP flags and one TCP value may be reported (when
available in the UNIX dialect) in the form of the
names that commonly appear after SO_, so_, SS_,
- TCP_ and TF_ in the dialect's header files - most
- often <sys/socket.h>, <sys/socketvar.h> and
- <netinet/tcp_var.h>. Consult those header files
- for the meaning of the flags, options, states and
- values.
- ``SO='' precedes socket options and values;
- ``SS='', socket states; and ``TF='', TCP flags and
- values.
- If a flag or option has a value, the value will
- follow an '=' and the name -- e.g.,
- ``SO=LINGER=5'', ``SO=QLIM=5'', ``TF=MSS=512''.
- The following seven values may be reported:
+SunOS 5.9 Last change: Revision-4.89 20
-SunOS 5.9 Last change: Revision-4.88 20
+Maintenance Procedures LSOF(8)
+ TCP_ and TF_ in the dialect's header files - most
+ often <sys/socket.h>, <sys/socketvar.h> and
+ <netinet/tcp_var.h>. Consult those header files
+ for the meaning of the flags, options, states and
+ values.
-Maintenance Procedures LSOF(8)
+ ``SO='' precedes socket options and values;
+ ``SS='', socket states; and ``TF='', TCP flags and
+ values.
+ If a flag or option has a value, the value will
+ follow an '=' and the name -- e.g.,
+ ``SO=LINGER=5'', ``SO=QLIM=5'', ``TF=MSS=512''.
+ The following seven values may be reported:
Name
KEEPALIVE keep alive time (SO_KEEPALIVE)
LINGER linger time (SO_LINGER)
MSS maximum segment size (TCP_MAXSEG)
- PQLEN partial listen queue connections
+ PQLEN partial listen queue connections
QLEN established listen queue connections
QLIM established listen queue limit
RCVBUF receive buffer length (SO_RCVBUF)
in a single ORed set before participating in AND
option selection.
+
+
+SunOS 5.9 Last change: Revision-4.89 21
+
+
+
+
+
+
+Maintenance Procedures LSOF(8)
+
+
+
If a login name or user ID is preceded by a `^', it
becomes a negation - i.e., files of processes owned
by the login name or user ID will never be listed.
-v selects the listing of lsof version information,
including: revision number; when the lsof binary
-
-
-
-SunOS 5.9 Last change: Revision-4.88 21
-
-
-
-
-
-
-Maintenance Procedures LSOF(8)
-
-
-
was constructed; who constructed the binary and
where; the name of the compiler used to construct
the lsof binary; the version number of the compiler
when they are already disabled or enabling them
when already enabled is acceptable.
- The -t option selects the -w option.
- -x [fl] may accompany the +d and +D options to direct their
- processing to cross over symbolic links and|or file
- system mount points encountered when scanning the
- directory (+d) or directory tree (+D).
- If -x is specified by itself without a following
- parameter, cross-over processing of both symbolic
- links and file system mount points is enabled.
- Note that when -x is specified without a parameter,
- the next argument must begin with '-' or '+'.
-
- The optional 'f' parameter enables file system
+SunOS 5.9 Last change: Revision-4.89 22
-SunOS 5.9 Last change: Revision-4.88 22
+Maintenance Procedures LSOF(8)
-Maintenance Procedures LSOF(8)
+ The -t option selects the -w option.
+ -x [fl] may accompany the +d and +D options to direct their
+ processing to cross over symbolic links and|or file
+ system mount points encountered when scanning the
+ directory (+d) or directory tree (+D).
+ If -x is specified by itself without a following
+ parameter, cross-over processing of both symbolic
+ links and file system mount points is enabled.
+ Note that when -x is specified without a parameter,
+ the next argument must begin with '-' or '+'.
+ The optional 'f' parameter enables file system
mount point cross-over processing; 'l', symbolic
link cross-over processing.
an AIX kernel directory search kernel error, known
as the Stale Segment ID bug.
- The readx() function, used by lsof or any other
- program to access some sections of kernel virtual
- memory, can trigger the Stale Segment ID bug. It
- can cause the kernel's dir_search() function to
- believe erroneously that part of an in-memory copy
- of a file system directory has been zeroed.
- Another application process, distinct from lsof,
- asking the kernel to search the directory - e.g.,
- by using open(2) - can cause dir_search() to loop
- forever, thus hanging the application process.
-
- Consult the lsof FAQ (The FAQ section gives its
- location.) and the 00README file of the lsof
-
-SunOS 5.9 Last change: Revision-4.88 23
+SunOS 5.9 Last change: Revision-4.89 23
- distribution for a more complete description of the
+ The readx() function, used by lsof or any other
+ program to access some sections of kernel virtual
+ memory, can trigger the Stale Segment ID bug. It
+ can cause the kernel's dir_search() function to
+ believe erroneously that part of an in-memory copy
+ of a file system directory has been zeroed.
+ Another application process, distinct from lsof,
+ asking the kernel to search the directory - e.g.,
+ by using open(2) - can cause dir_search() to loop
+ forever, thus hanging the application process.
+
+ Consult the lsof FAQ (The FAQ section gives its
+ location.) and the 00README file of the lsof dis-
+ tribution for a more complete description of the
Stale Segment ID bug, its APAR, and methods for
defining readx() use when compiling lsof.
-z [z] specifies how Solaris 10 and higher zone informa-
tion is to be handled.
- Without a following argument - e.g., NO z - the
- option specifies that zone names are to be listed
- in the ZONE output column.
- The -z option may be followed by a zone name, z.
- That causes lsof to list only open files for
- processes in that zone. Multiple -z z option and
- argument pairs may be specified to form a list of
- named zones. Any open file of any process in any
- of the zones will be listed, subject to other con-
- ditions specified by other options and arguments.
- -Z [Z] specifies how SELinux security contexts are to be
+SunOS 5.9 Last change: Revision-4.89 24
-SunOS 5.9 Last change: Revision-4.88 24
+Maintenance Procedures LSOF(8)
-Maintenance Procedures LSOF(8)
+ Without a following argument - e.g., NO z - the
+ option specifies that zone names are to be listed
+ in the ZONE output column.
+ The -z option may be followed by a zone name, z.
+ That causes lsof to list only open files for
+ processes in that zone. Multiple -z z option and
+ argument pairs may be specified to form a list of
+ named zones. Any open file of any process in any
+ of the zones will be listed, subject to other con-
+ ditions specified by other options and arguments.
+ -Z [Z] specifies how SELinux security contexts are to be
handled. It and 'Z' field output character support
are inhibited when SELinux is disabled in the run-
ning Linux kernel. See OUTPUT FOR OTHER PROGRAMS
list all the files open on the file system. To be
considered a file system, the name must match a
mounted-on directory name in mount(8) output, or
+
+
+
+SunOS 5.9 Last change: Revision-4.89 25
+
+
+
+
+
+
+Maintenance Procedures LSOF(8)
+
+
+
match the name of a block device associated with a
mounted-on directory name. The +|-f option may be
used to force lsof to consider a name a file system
request that lsof look for open files inside a
directory name, use the +d s and +D D options.
-
-
-SunOS 5.9 Last change: Revision-4.88 25
-
-
-
-
-
-
-Maintenance Procedures LSOF(8)
-
-
-
If a name is the base name of a family of multi-
- plexed files - e. g, AIX's /dev/pt[cs] - lsof will
+ plexed files - e.g, AIX's /dev/pt[cs] - lsof will
list all the associated multiplexed files on the
device that are open - e.g., /dev/pt[cs]/1,
/dev/pt[cs]/2, etc.
If a name is none of the above, lsof will list any
open files whose device and inode match that of the
- specified path name.
-
- If you have also specified the -b option, the only
- names you may safely specify are file systems for
- which your mount table supplies alternate device
- numbers. See the AVOIDING KERNEL BLOCKS and ALTER-
- NATE DEVICE NUMBERS sections for more information.
-
- Multiple file names are joined in a single ORed set
- before participating in AND option selection.
-
-AFS
- Lsof supports the recognition of AFS files for these
- dialects (and AFS versions):
-
+ specified path name.
-SunOS 5.9 Last change: Revision-4.88 26
+SunOS 5.9 Last change: Revision-4.89 26
+ If you have also specified the -b option, the only
+ names you may safely specify are file systems for
+ which your mount table supplies alternate device
+ numbers. See the AVOIDING KERNEL BLOCKS and ALTER-
+ NATE DEVICE NUMBERS sections for more information.
+
+ Multiple file names are joined in a single ORed set
+ before participating in AND option selection.
+
+AFS
+ Lsof supports the recognition of AFS files for these
+ dialects (and AFS versions):
+
AIX 4.1.4 (AFS 3.4a)
HP-UX 9.0.5 (AFS 3.4a)
Linux 1.2.13 (AFS 3.3)
Lsof has three features that may cause security concerns.
First, its default compilation mode allows anyone to list
all open files with it. Second, by default it creates a
+
+
+
+SunOS 5.9 Last change: Revision-4.89 27
+
+
+
+
+
+
+Maintenance Procedures LSOF(8)
+
+
+
user-readable and user-writable device cache file in the
home directory of the real user ID that executes lsof. (The
list-all-open-files and device cache features may be dis-
tion number as the real user ID number of the lsof process
(the one that its user logged on with).
-
-
-SunOS 5.9 Last change: Revision-4.88 27
-
-
-
-
-
-
-Maintenance Procedures LSOF(8)
-
-
-
However, if HASSECURITY and HASNOSOCKSECURITY are both
defined, anyone may list open socket files, provided they
are selected with the -i option.
of the lsof distribution and the lsof FAQ (The FAQ section
gives its location.)
- WHEN IN DOUBT, YOU CAN TEMPORARILY DISABLE THE USE OF THE
- DEVICE CACHE FILE WITH THE -Di OPTION.
-
- When lsof user declares alternate kernel name list or memory
- files with the -k and -m options, lsof checks the user's
- authority to read them with access(2). This is intended to
- prevent whatever special power lsof's modes might confer on
- it from letting it read files not normally accessible via
- the authority of the real user ID.
-OUTPUT
- This section describes the information lsof lists for each
- open file. See the OUTPUT FOR OTHER PROGRAMS section for
+SunOS 5.9 Last change: Revision-4.89 28
-SunOS 5.9 Last change: Revision-4.88 28
+Maintenance Procedures LSOF(8)
-Maintenance Procedures LSOF(8)
+ WHEN IN DOUBT, YOU CAN TEMPORARILY DISABLE THE USE OF THE
+ DEVICE CACHE FILE WITH THE -Di OPTION.
+ When lsof user declares alternate kernel name list or memory
+ files with the -k and -m options, lsof checks the user's
+ authority to read them with access(2). This is intended to
+ prevent whatever special power lsof's modes might confer on
+ it from letting it read files not normally accessible via
+ the authority of the real user ID.
+OUTPUT
+ This section describes the information lsof lists for each
+ open file. See the OUTPUT FOR OTHER PROGRAMS section for
additional information on output that can be processed by
another program.
tions in the lsof FAQ (The FAQ section gives its location.)
for more information.
- Lsof dynamically sizes the output columns each time it runs,
- guaranteeing that each column is a minimum size. It also
- guarantees that each column is separated from its predeces-
- sor by at least one space.
-
- COMMAND contains the first nine characters of the name of
- the UNIX command associated with the process. If
- a non-zero w value is specified to the +c w
- option, the column contains the first w charac-
- ters of the name of the UNIX command associated
- with the process up to the limit of characters
- supplied to lsof by the UNIX dialect. (See the
-
-SunOS 5.9 Last change: Revision-4.88 29
+SunOS 5.9 Last change: Revision-4.89 29
+ Lsof dynamically sizes the output columns each time it runs,
+ guaranteeing that each column is a minimum size. It also
+ guarantees that each column is separated from its predeces-
+ sor by at least one space.
+
+ COMMAND contains the first nine characters of the name of
+ the UNIX command associated with the process. If
+ a non-zero w value is specified to the +c w
+ option, the column contains the first w charac-
+ ters of the name of the UNIX command associated
+ with the process up to the limit of characters
+ supplied to lsof by the UNIX dialect. (See the
description of the +c w command or the lsof FAQ
for more information. The FAQ section gives its
location.)
the -Z option is inhibited when SELinux is dis-
abled in the running Linux kernel.
- PPID is the Parent Process IDentification number of
- the process. It is only displayed when the -R
- option has been specified.
-
- PGID is the process group IDentification number asso-
- ciated with the process. It is only displayed
- when the -g option has been specified.
- USER is the user ID number or login name of the user
- to whom the process belongs, usually the same as
- reported by ps(1). However, on Linux USER is the
+SunOS 5.9 Last change: Revision-4.89 30
-SunOS 5.9 Last change: Revision-4.88 30
+Maintenance Procedures LSOF(8)
-Maintenance Procedures LSOF(8)
+ PPID is the Parent Process IDentification number of
+ the process. It is only displayed when the -R
+ option has been specified.
+ PGID is the process group IDentification number asso-
+ ciated with the process. It is only displayed
+ when the -g option has been specified.
+ USER is the user ID number or login name of the user
+ to whom the process belongs, usually the same as
+ reported by ps(1). However, on Linux USER is the
user ID number or login that owns the directory
in /proc where lsof finds information about the
process. Usually that is the same value reported
lock characters, describing the type of lock
applied to the file:
- N for a Solaris NFS lock of unknown type;
- r for read lock on part of the file;
- R for a read lock on the entire file;
- w for a write lock on part of the file;
- W for a write lock on the entire file;
- u for a read and write lock of any length;
- U for a lock of unknown type;
- x for an SCO OpenServer Xenix lock on part
- of the file;
- X for an SCO OpenServer Xenix lock on the
- entire file;
-SunOS 5.9 Last change: Revision-4.88 31
+SunOS 5.9 Last change: Revision-4.89 31
+ N for a Solaris NFS lock of unknown type;
+ r for read lock on part of the file;
+ R for a read lock on the entire file;
+ w for a write lock on part of the file;
+ W for a write lock on the entire file;
+ u for a read and write lock of any length;
+ U for a lock of unknown type;
+ x for an SCO OpenServer Xenix lock on part
+ of the file;
+ X for an SCO OpenServer Xenix lock on the
+ entire file;
space if there is no lock.
See the LOCKS section for more information on the
or ``DOOR'' for a VDOOR file;
- or ``FIFO'' for a FIFO special file;
- or ``KQUEUE'' for a BSD style kernel event queue
- file;
- or ``LINK'' for a symbolic link file;
+SunOS 5.9 Last change: Revision-4.89 32
- or ``MPB'' for a multiplexed block file;
- or ``MPC'' for a multiplexed character file;
-SunOS 5.9 Last change: Revision-4.88 32
+Maintenance Procedures LSOF(8)
+ or ``FIFO'' for a FIFO special file;
+ or ``KQUEUE'' for a BSD style kernel event queue
+ file;
-Maintenance Procedures LSOF(8)
+ or ``LINK'' for a symbolic link file;
+ or ``MPB'' for a multiplexed block file;
+ or ``MPC'' for a multiplexed character file;
or ``NOFD'' for a Linux /proc/<PID>/fd directory
that can't be opened -- the directory path
or ``PLDR'' for a /proc/lpw directory;
- or ``PLDT'' for a /proc/ldt file;
- or ``PLPI'' for a /proc/lpsinfo file;
- or ``PLST'' for a /proc/lstatus file;
- or ``PLU'' for a /proc/lusage file;
+SunOS 5.9 Last change: Revision-4.89 33
- or ``PLWG'' for a /proc/gwindows file;
- or ``PLWI'' for a /proc/lwpsinfo file;
-SunOS 5.9 Last change: Revision-4.88 33
+
+Maintenance Procedures LSOF(8)
+ or ``PLDT'' for a /proc/ldt file;
+ or ``PLPI'' for a /proc/lpsinfo file;
+ or ``PLST'' for a /proc/lstatus file;
-Maintenance Procedures LSOF(8)
+ or ``PLU'' for a /proc/lusage file;
+ or ``PLWG'' for a /proc/gwindows file;
+ or ``PLWI'' for a /proc/lwpsinfo file;
or ``PLWS'' for a /proc/lwpstatus file;
or ``PLWU'' for a /proc/lwpusage file;
- or ``PLWX'' for a /proc/xregs file'
+ or ``PLWX'' for a /proc/xregs file;
or ``PMAP'' for a /proc map file (map);
or ``PSXSEM'' for a POSIX semaphore file;
- or ``PSXSHM'' for a POSIX shared memory file;
- or ``PUSG'' for a /proc/usage file;
- or ``PW'' for a /proc/watch file;
- or ``PXMP'' for a /proc/xmap file;
+SunOS 5.9 Last change: Revision-4.89 34
- or ``REG'' for a regular file;
- or ``SMT'' for a shared memory transport file;
-SunOS 5.9 Last change: Revision-4.88 34
+Maintenance Procedures LSOF(8)
+ or ``PSXSHM'' for a POSIX shared memory file;
+ or ``PUSG'' for a /proc/usage file;
+ or ``PW'' for a /proc/watch file;
-Maintenance Procedures LSOF(8)
+ or ``PXMP'' for a /proc/xmap file;
+ or ``REG'' for a regular file;
+ or ``SMT'' for a shared memory transport file;
or ``STSO'' for a stream socket;
BAS block, test, and set in use
BKIU block if in use
BL use block offsets
- BSK block seek
- CA copy avoid
- CIO concurrent I/O
- CLON clone
- CLRD CL read
- CR create
- DF defer
- DFI defer IND
- DFLU data flush
- DIR direct
- DLY delay
- DOCL do clone
-SunOS 5.9 Last change: Revision-4.88 35
+SunOS 5.9 Last change: Revision-4.89 35
+ BSK block seek
+ CA copy avoid
+ CIO concurrent I/O
+ CLON clone
+ CLRD CL read
+ CR create
+ DF defer
+ DFI defer IND
+ DFLU data flush
+ DIR direct
+ DLY delay
+ DOCL do clone
DSYN data-only integrity
DTY must be a directory
EVO event only
REV revoked
RSH shared read
RSYN read synchronization
- RW read and write access
- SL shared lock
- SNAP cooked snapshot
- SOCK socket
- SQSH Sequent shared set on open
- SQSV Sequent SVM set on open
- SQR Sequent set repair on open
- SQS1 Sequent full shared open
- SQS2 Sequent partial shared open
- STPI stop I/O
- SWR synchronous read
- SYN file integrity while writing
-SunOS 5.9 Last change: Revision-4.88 36
+SunOS 5.9 Last change: Revision-4.89 36
+ RW read and write access
+ SL shared lock
+ SNAP cooked snapshot
+ SOCK socket
+ SQSH Sequent shared set on open
+ SQSV Sequent SVM set on open
+ SQR Sequent set repair on open
+ SQS1 Sequent full shared open
+ SQS2 Sequent partial shared open
+ STPI stop I/O
+ SWR synchronous read
+ SYN file integrity while writing
TCPM avoid TCP collision
TR truncate
W write
ally a concatenation of device and node number)
when n has been specified to +f;
- DEVICE contains the device numbers, separated by commas,
- for a character special, block special, regular,
- directory or NFS file;
- or ``memory'' for a memory file system node under
- Tru64 UNIX;
- or the address of the private data area of a
- Solaris socket stream;
- or a kernel reference address that identifies the
- file (The kernel reference address may be used
+SunOS 5.9 Last change: Revision-4.89 37
-SunOS 5.9 Last change: Revision-4.88 37
+Maintenance Procedures LSOF(8)
-Maintenance Procedures LSOF(8)
+ DEVICE contains the device numbers, separated by commas,
+ for a character special, block special, regular,
+ directory or NFS file;
+ or ``memory'' for a memory file system node under
+ Tru64 UNIX;
+ or the address of the private data area of a
+ Solaris socket stream;
+ or a kernel reference address that identifies the
+ file (The kernel reference address may be used
for FIFO's, for example.);
or the base address or device name of a Linux
decimal with a leading ``0x'' if it is longer
than 8 digits. (Consult the -o o option descrip-
tion for information on when 8 might default to
- some other value.)
-
- Thus the leading ``0t'' and ``0x'' identify an
- offset when the column may contain both a size
- and an offset (i.e., its title is SIZE/OFF).
-
- If the -o option is specified, lsof always
- displays the file offset (or nothing if no offset
- is available) and labels the column OFFSET. The
- offset always begins with ``0t'' or ``0x'' as
- described above.
-
- The lsof user can control the switch from ``0t''
- to ``0x'' with the -o o option. Consult its
- description for more information.
+ some other value.)
- If the -s option is specified, lsof always
- displays the file size (or nothing if no size is
- available) and labels the column SIZE. The -o
+ Thus the leading ``0t'' and ``0x'' identify an
+ offset when the column may contain both a size
+ and an offset (i.e., its title is SIZE/OFF).
+
+ If the -o option is specified, lsof always
-SunOS 5.9 Last change: Revision-4.88 38
+SunOS 5.9 Last change: Revision-4.89 38
+ displays the file offset (or nothing if no offset
+ is available) and labels the column OFFSET. The
+ offset always begins with ``0t'' or ``0x'' as
+ described above.
+
+ The lsof user can control the switch from ``0t''
+ to ``0x'' with the -o o option. Consult its
+ description for more information.
+
+ If the -s option is specified, lsof always
+ displays the file size (or nothing if no size is
+ available) and labels the column SIZE. The -o
and -s options are mutually exclusive; they can't
both be specified.
or the inode number of an NFS file in the server
host;
- or the Internet protocol type - e. g, ``TCP'';
+ or the Internet protocol type - e.g, ``TCP'';
or ``STR'' for a stream;
network file; the local host name or IP number is
followed by a colon (':'), the port, ``->'', and
the two-part remote address; IP addresses may be
- reported as numbers or names, depending on the
- +|-M, -n, and -P options; colon-separated IPv6
- numbers are enclosed in square brackets; IPv4
- INADDR_ANY and IPv6 IN6_IS_ADDR_UNSPECIFIED
- addresses, and zero port numbers are represented
- by an asterisk ('*'); a UDP destination address
- may be followed by the amount of time elapsed
- since the last packet was sent to the destina-
- tion; TCP, UDP and UDPLITE remote addresses may
- be followed by TCP/TPI information in parentheses
- - state (e.g., ``(ESTABLISHED)'', ``(Unbound)''),
- queue sizes, and window sizes (not all dialects)
-SunOS 5.9 Last change: Revision-4.88 39
+SunOS 5.9 Last change: Revision-4.89 39
+ reported as numbers or names, depending on the
+ +|-M, -n, and -P options; colon-separated IPv6
+ numbers are enclosed in square brackets; IPv4
+ INADDR_ANY and IPv6 IN6_IS_ADDR_UNSPECIFIED
+ addresses, and zero port numbers are represented
+ by an asterisk ('*'); a UDP destination address
+ may be followed by the amount of time elapsed
+ since the last packet was sent to the destina-
+ tion; TCP, UDP and UDPLITE remote addresses may
+ be followed by TCP/TPI information in parentheses
+ - state (e.g., ``(ESTABLISHED)'', ``(Unbound)''),
+ queue sizes, and window sizes (not all dialects)
- in a fashion similar to what netstat(1)
reports; see the -T option description or the
description of the TCP/TPI field in OUTPUT FOR
followed by fourteen comma-separated bytes of a
non-Internet raw socket address;
- or the HP-UX x.25 local address, followed by the
- virtual connection number (if any), followed by
- the remote address (if any);
-
- or ``(dead)'' for disassociated Tru64 UNIX files
- - typically terminal files that have been flagged
- with the TIOCNOTTY ioctl and closed by daemons;
- or ``rd=<offset>'' and ``wr=<offset>'' for the
- values of the read and write offsets of a FIFO;
+SunOS 5.9 Last change: Revision-4.89 40
-SunOS 5.9 Last change: Revision-4.88 40
+Maintenance Procedures LSOF(8)
-Maintenance Procedures LSOF(8)
+ or the HP-UX x.25 local address, followed by the
+ virtual connection number (if any), followed by
+ the remote address (if any);
+ or ``(dead)'' for disassociated Tru64 UNIX files
+ - typically terminal files that have been flagged
+ with the TIOCNOTTY ioctl and closed by daemons;
+ or ``rd=<offset>'' and ``wr=<offset>'' for the
+ values of the read and write offsets of a FIFO;
or ``clone n:/dev/event'' for SCO OpenServer file
clones of the /dev/event device, where n is the
vnode addresses. <direction> will be ``<-'' if <address2>
has been fattach'ed to this vnode whose address is
<address1>; and ``->'' if <address1>, the vnode address of
- this vnode, has been fattach'ed to <address2>. <address1>
- may be omitted if it already appears in the DEVICE column.
- Lsof may add two parenthetical notes to the NAME column for
- open Solaris 10 files: ``(?)'' if lsof considers the path
- name of questionable accuracy; and ``(deleted)'' if the -X
- option has been specified and lsof detects the open file's
- path name has been deleted. Consult the lsof FAQ (The FAQ
- section gives its location.) for more information on these
- NAME column additions.
+SunOS 5.9 Last change: Revision-4.89 41
-SunOS 5.9 Last change: Revision-4.88 41
+Maintenance Procedures LSOF(8)
-Maintenance Procedures LSOF(8)
+ this vnode, has been fattach'ed to <address2>. <address1>
+ may be omitted if it already appears in the DEVICE column.
+ Lsof may add two parenthetical notes to the NAME column for
+ open Solaris 10 files: ``(?)'' if lsof considers the path
+ name of questionable accuracy; and ``(deleted)'' if the -X
+ option has been specified and lsof detects the open file's
+ path name has been deleted. Consult the lsof FAQ (The FAQ
+ section gives its location.) for more information on these
+ NAME column additions.
LOCKS
Lsof can't adequately report the wide variety of UNIX
It is possible to think of field output as process and file
sets. A process set begins with a field whose identifier is
`p' (for process IDentifier (PID)). It extends to the
- beginning of the next PID field or the beginning of the
- first file set of the process, whichever comes first.
- Included in the process set are fields that identify the
- command, the process group IDentification (PGID) number, the
- task (thread) ID (TID), and the user ID (UID) number or
- login name.
-
- A file set begins with a field whose identifier is `f' (for
- file descriptor). It is followed by lines that describe the
- file's access mode, lock state, type, device, size, offset,
- inode, protocol, name and stream module names. It extends
-SunOS 5.9 Last change: Revision-4.88 42
+SunOS 5.9 Last change: Revision-4.89 42
+ beginning of the next PID field or the beginning of the
+ first file set of the process, whichever comes first.
+ Included in the process set are fields that identify the
+ command, the process group IDentification (PGID) number, the
+ task (thread) ID (TID), and the user ID (UID) number or
+ login name.
+
+ A file set begins with a field whose identifier is `f' (for
+ file descriptor). It is followed by lines that describe the
+ file's access mode, lock state, type, device, size, offset,
+ inode, protocol, name and stream module names. It extends
to the beginning of the next file or process set, whichever
comes first.
K tasK ID
k link count
l file's lock status
- L process login name
- m marker between repeated output
- n file name, comment, Internet address
- N node identifier (ox<hexadecimal>
- o file's offset (decimal)
- p process ID (always selected)
- P protocol name
- r raw device number (0x<hexadecimal>)
- R parent process ID
- s file's size (decimal)
- S file's stream identification
-SunOS 5.9 Last change: Revision-4.88 43
+SunOS 5.9 Last change: Revision-4.89 43
+ L process login name
+ m marker between repeated output
+ n file name, comment, Internet address
+ N node identifier (ox<hexadecimal>
+ o file's offset (decimal)
+ p process ID (always selected)
+ P protocol name
+ r raw device number (0x<hexadecimal>)
+ R parent process ID
+ s file's size (decimal)
+ S file's stream identification
t file's type
T TCP/TPI information, identified by prefixes (the
`=' is part of the prefix):
device numbers; file inode number and protocol name; file
name and stream identification; file size and offset. One
or the other member of these mutually exclusive sets will
- appear in field output, but not both.
- Normally lsof ends each field with a NL (012) character.
- The 0 (zero) field identifier character may be specified to
- change the field terminator character to a NUL (000). A NUL
- terminator may be easier to process with xargs (1), for
- example, or with programs whose quoting mechanisms may not
- easily cope with the range of characters in the field out-
- put. When the NUL field terminator is in use, lsof ends
- each process and file set with a NL (012).
+SunOS 5.9 Last change: Revision-4.89 44
-SunOS 5.9 Last change: Revision-4.88 44
+Maintenance Procedures LSOF(8)
-Maintenance Procedures LSOF(8)
+ appear in field output, but not both.
+ Normally lsof ends each field with a NL (012) character.
+ The 0 (zero) field identifier character may be specified to
+ change the field terminator character to a NUL (000). A NUL
+ terminator may be easier to process with xargs (1), for
+ example, or with programs whose quoting mechanisms may not
+ easily cope with the range of characters in the field out-
+ put. When the NUL field terminator is in use, lsof ends
+ each process and file set with a NL (012).
Three aids to producing programs that can process lsof field
output are included in the lsof distribution. The first is
file system information, it normally continues, although
with less information available to display about open files.
- Lsof can also be directed to avoid the protection of timers
- and child processes when using the kernel functions that
- might block by specifying the -O option. While this will
- allow lsof to start up with less overhead, it exposes lsof
- completely to the kernel situations that might block it.
- Use this option cautiously.
-AVOIDING KERNEL BLOCKS
- You can use the -b option to tell lsof to avoid using kernel
- functions that would block. Some cautions apply.
+SunOS 5.9 Last change: Revision-4.89 45
-SunOS 5.9 Last change: Revision-4.88 45
+Maintenance Procedures LSOF(8)
-Maintenance Procedures LSOF(8)
+ Lsof can also be directed to avoid the protection of timers
+ and child processes when using the kernel functions that
+ might block by specifying the -O option. While this will
+ allow lsof to start up with less overhead, it exposes lsof
+ completely to the kernel situations that might block it.
+ Use this option cautiously.
+AVOIDING KERNEL BLOCKS
+ You can use the -b option to tell lsof to avoid using kernel
+ functions that would block. Some cautions apply.
First, using this option usually requires that your system
supply alternate device numbers in place of the device
lsof will report the device number it obtained. (You can
suppress the report by specifying the -w option.)
- You can assist this process if your mount table is supported
- with an /etc/mtab or /etc/mnttab file that contains an
- options field by adding a ``dev=xxxx'' field for mount
- points that do not have one in their options strings. Note:
- you must be able to edit the file - i.e., some mount tables
- like recent Solaris /etc/mnttab or Linux /proc/mounts are
- read-only and can't be modified.
-
- You may also be able to supply device numbers using the +m
- and +m m options, provided they are supported by your
- dialect. Check the output of lsof's -h or -? options to see
-SunOS 5.9 Last change: Revision-4.88 46
+SunOS 5.9 Last change: Revision-4.89 46
+ You can assist this process if your mount table is supported
+ with an /etc/mtab or /etc/mnttab file that contains an
+ options field by adding a ``dev=xxxx'' field for mount
+ points that do not have one in their options strings. Note:
+ you must be able to edit the file - i.e., some mount tables
+ like recent Solaris /etc/mnttab or Linux /proc/mounts are
+ read-only and can't be modified.
+
+ You may also be able to supply device numbers using the +m
+ and +m m options, provided they are supported by your
+ dialect. Check the output of lsof's -h or -? options to see
if the +m and +m m options are available.
The ``xxxx'' portion of the field is the hexadecimal value
``assuming "dev=xxxx" from ...''.
KERNEL NAME CACHE
- Lsof is able to examine the kernel's name cache or use other
- kernel facilities (e.g., the ADVFS 4.x tag_to_path() func-
- tion under Tru64 UNIX) on some dialects for most file system
- types, excluding AFS, and extract recently used path name
- components from it. (AFS file system path lookups don't use
- the kernel's name cache; some Solaris VxFS file system
- operations apparently don't use it, either.)
- Lsof reports the complete paths it finds in the NAME column.
- If lsof can't report all components in a path, it reports in
- the NAME column the file system name, followed by a space,
- two `-' characters, another space, and the name components
-SunOS 5.9 Last change: Revision-4.88 47
+SunOS 5.9 Last change: Revision-4.89 47
+ Lsof is able to examine the kernel's name cache or use other
+ kernel facilities (e.g., the ADVFS 4.x tag_to_path() func-
+ tion under Tru64 UNIX) on some dialects for most file system
+ types, excluding AFS, and extract recently used path name
+ components from it. (AFS file system path lookups don't use
+ the kernel's name cache; some Solaris VxFS file system
+ operations apparently don't use it, either.)
+
+ Lsof reports the complete paths it finds in the NAME column.
+ If lsof can't report all components in a path, it reports in
+ the NAME column the file system name, followed by a space,
+ two `-' characters, another space, and the name components
it has located, separated by the `/' character.
When lsof is run in repeat mode - i.e., with the -r option
If you want to know why lsof can't report path name com-
ponents for some dialects, see the lsof FAQ (The FAQ section
- gives its location.)
-DEVICE CACHE FILE
- Examining all members of the /dev (or /devices) node tree
- with stat(2) functions can be time consuming. What's more,
- the information that lsof needs - device number, inode
- number, and path - rarely changes.
- Consequently, lsof normally maintains an ASCII text file of
- cached /dev (or /devices) information (exception: the
- /proc-based Linux lsof where it's not needed.) The local
- system administrator who builds lsof can control the way the
+SunOS 5.9 Last change: Revision-4.89 48
-SunOS 5.9 Last change: Revision-4.88 48
+Maintenance Procedures LSOF(8)
-Maintenance Procedures LSOF(8)
+ gives its location.)
+DEVICE CACHE FILE
+ Examining all members of the /dev (or /devices) node tree
+ with stat(2) functions can be time consuming. What's more,
+ the information that lsof needs - device number, inode
+ number, and path - rarely changes.
+ Consequently, lsof normally maintains an ASCII text file of
+ cached /dev (or /devices) information (exception: the
+ /proc-based Linux lsof where it's not needed.) The local
+ system administrator who builds lsof can control the way the
device cache file path is formed, selecting from these
options:
When a new device is added to the system, the device cache
file may need to be recreated. Since lsof compares the
mtime of the device cache file with the mtime and ctime of
- the /dev (or /devices) directory, it usually detects that a
- new device has been added; in that case lsof issues a warn-
- ing message and attempts to rebuild the device cache file.
- Whenever lsof writes a device cache file, it sets its owner-
- ship to the real UID of the executing process, and its per-
- mission modes to 0600, this restricting its reading and
- writing to the file's owner.
-LSOF PERMISSIONS THAT AFFECT DEVICE CACHE FILE ACCESS
- Two permissions of the lsof executable affect its ability to
- access device cache files. The permissions are set by the
+SunOS 5.9 Last change: Revision-4.89 49
-SunOS 5.9 Last change: Revision-4.88 49
+Maintenance Procedures LSOF(8)
-Maintenance Procedures LSOF(8)
+ the /dev (or /devices) directory, it usually detects that a
+ new device has been added; in that case lsof issues a warn-
+ ing message and attempts to rebuild the device cache file.
+ Whenever lsof writes a device cache file, it sets its owner-
+ ship to the real UID of the executing process, and its per-
+ mission modes to 0600, this restricting its reading and
+ writing to the file's owner.
+LSOF PERMISSIONS THAT AFFECT DEVICE CACHE FILE ACCESS
+ Two permissions of the lsof executable affect its ability to
+ access device cache files. The permissions are set by the
local system administrator when lsof is installed.
The first and rarer permission is setuid-root. It comes
Solaris 2.6, 8, 9 and 10
Tru64 UNIX 5.1
- (Note: lsof for AIX 5L and above needs setuid-root permis-
- sion if its -X option is used.)
- Lsof for these dialects does not support a device cache, so
- the permissions given to the executable don't apply to the
- device cache file.
- Linux
-DEVICE CACHE FILE PATH FROM THE -D OPTION
- The -D option provides limited means for specifying the dev-
- ice cache file path. Its ? function will report the
- read-only and write device cache file paths that lsof will
+
+SunOS 5.9 Last change: Revision-4.89 50
-SunOS 5.9 Last change: Revision-4.88 50
+Maintenance Procedures LSOF(8)
-Maintenance Procedures LSOF(8)
+ (Note: lsof for AIX 5L and above needs setuid-root permis-
+ sion if its -X option is used.)
+ Lsof for these dialects does not support a device cache, so
+ the permissions given to the executable don't apply to the
+ device cache file.
+ Linux
+DEVICE CACHE FILE PATH FROM THE -D OPTION
+ The -D option provides limited means for specifying the dev-
+ ice cache file path. Its ? function will report the
+ read-only and write device cache file paths that lsof will
use.
When the -D b, r, and u functions are available, you can use
only to a path it considers legitimate for the lsof process
effective and real UIDs.
-DEVICE CACHE PATH FROM AN ENVIRONMENT VARIABLE
- Lsof's second choice for the device cache file is the con-
- tents of the LSOFDEVCACHE environment variable. It avoids
- this choice if the lsof process is setuid-root, or the real
- UID of the process is root.
-
- A further restriction applies to a device cache file path
- taken from the LSOFDEVCACHE environment variable: lsof will
- not write a device cache file to the path if the lsof pro-
- cess doesn't surrender its setgid permission. (See the LSOF
- PERMISSIONS THAT AFFECT DEVICE CACHE FILE ACCESS section for
- information on implementations that don't surrender their
- setgid permission.)
-SunOS 5.9 Last change: Revision-4.88 51
+SunOS 5.9 Last change: Revision-4.89 51
+DEVICE CACHE PATH FROM AN ENVIRONMENT VARIABLE
+ Lsof's second choice for the device cache file is the con-
+ tents of the LSOFDEVCACHE environment variable. It avoids
+ this choice if the lsof process is setuid-root, or the real
+ UID of the process is root.
+
+ A further restriction applies to a device cache file path
+ taken from the LSOFDEVCACHE environment variable: lsof will
+ not write a device cache file to the path if the lsof pro-
+ cess doesn't surrender its setgid permission. (See the LSOF
+ PERMISSIONS THAT AFFECT DEVICE CACHE FILE ACCESS section for
+ information on implementations that don't surrender their
+ setgid permission.)
+
The local system administrator can disable the use of the
LSOFDEVCACHE environment variable or change its name when
building lsof. Consult the output of -D? for the environ-
cache file. This is the only time lsof uses two paths when
reading the device cache file.
- The hostname part of the second component is the base name
- of the executing host, as returned by gethostname(2). The
- base name is defined to be the characters preceding the
- first `.' in the gethostname(2) output, or all the gethost-
- name(2) output if it contains no `.'.
- The device cache file belongs to the user ID and is readable
- and writable by the user ID alone - i.e., its modes are
- 0600. Each distinct real user ID on a given host that exe-
- cutes lsof has a distinct device cache file. The hostname
- part of the path distinguishes device cache files in an
- NFS-mounted home directory into which device cache files are
- written from several different hosts.
+SunOS 5.9 Last change: Revision-4.89 52
-SunOS 5.9 Last change: Revision-4.88 52
+Maintenance Procedures LSOF(8)
-Maintenance Procedures LSOF(8)
+ The hostname part of the second component is the base name
+ of the executing host, as returned by gethostname(2). The
+ base name is defined to be the characters preceding the
+ first `.' in the gethostname(2) output, or all the gethost-
+ name(2) output if it contains no `.'.
+ The device cache file belongs to the user ID and is readable
+ and writable by the user ID alone - i.e., its modes are
+ 0600. Each distinct real user ID on a given host that exe-
+ cutes lsof has a distinct device cache file. The hostname
+ part of the path distinguishes device cache files in an
+ NFS-mounted home directory into which device cache files are
+ written from several different hosts.
The personal device cache file path formed by this method
represents a device cache file that lsof will attempt to
lsof process is setuid-root or when the real UID of the pro-
cess is root.
- Lsof will not write to a modified personal device cache file
- path if the lsof process doesn't surrender setgid permis-
- sion. (See the LSOF PERMISSIONS THAT AFFECT DEVICE CACHE
- FILE ACCESS section for a list of implementations that nor-
- mally don't surrender their setgid permission.)
-
- If, for example, you want to create a sub-directory of per-
- sonal device cache file paths by using the LSOFPERSDCPATH
- environment variable to name it, and lsof doesn't surrender
- its setgid permission, you will have to allow lsof to create
- device cache files at the standard personal path and move
- them to your subdirectory with shell commands.
+SunOS 5.9 Last change: Revision-4.89 53
-SunOS 5.9 Last change: Revision-4.88 53
+Maintenance Procedures LSOF(8)
-Maintenance Procedures LSOF(8)
+ Lsof will not write to a modified personal device cache file
+ path if the lsof process doesn't surrender setgid permis-
+ sion. (See the LSOF PERMISSIONS THAT AFFECT DEVICE CACHE
+ FILE ACCESS section for a list of implementations that nor-
+ mally don't surrender their setgid permission.)
+ If, for example, you want to create a sub-directory of per-
+ sonal device cache file paths by using the LSOFPERSDCPATH
+ environment variable to name it, and lsof doesn't surrender
+ its setgid permission, you will have to allow lsof to create
+ device cache files at the standard personal path and move
+ them to your subdirectory with shell commands.
The local system administrator may: disable this option when
lsof is built; change the name of the environment variable
definition. In this case, the output from the help options
will include the message:
- Inaccessible /dev warnings are disabled.
- Inaccessible device warning messages usually disappear after
- lsof has created a working device cache file.
-EXAMPLES
- For a more extensive set of examples, documented more fully,
- see the 00QUICKSTART file of the lsof distribution.
- To list all open files, use:
- lsof
+SunOS 5.9 Last change: Revision-4.89 54
-SunOS 5.9 Last change: Revision-4.88 54
+Maintenance Procedures LSOF(8)
+ Inaccessible /dev warnings are disabled.
+ Inaccessible device warning messages usually disappear after
+ lsof has created a working device cache file.
-Maintenance Procedures LSOF(8)
+EXAMPLES
+ For a more extensive set of examples, documented more fully,
+ see the 00QUICKSTART file of the lsof distribution.
+ To list all open files, use:
+ lsof
To list all open Internet, x.25 (HP-UX), and UNIX domain
files, use:
lsof /u/abe/foo
- To send a SIGHUP to the processes that have /u/abe/bar open,
- use:
- kill -HUP `lsof -t /u/abe/bar`
- To find any open file, including an open UNIX domain socket
- file, with the name /dev/log, use:
- lsof /dev/log
+SunOS 5.9 Last change: Revision-4.89 55
- To find processes with open files on the NFS file system
- named /nfs/mount/point whose server is inaccessible, and
- presuming your mount table supplies the device number for
-SunOS 5.9 Last change: Revision-4.88 55
+Maintenance Procedures LSOF(8)
+ To send a SIGHUP to the processes that have /u/abe/bar open,
+ use:
-Maintenance Procedures LSOF(8)
+ kill -HUP `lsof -t /u/abe/bar`
+ To find any open file, including an open UNIX domain socket
+ file, with the name /dev/log, use:
+ lsof /dev/log
+ To find processes with open files on the NFS file system
+ named /nfs/mount/point whose server is inaccessible, and
+ presuming your mount table supplies the device number for
/nfs/mount/point, use:
lsof -b /nfs/mount/point
To find an IP version 6 socket file (when the UNIX dialect
supports IPv6) by its associated numeric colon-form address,
- use:
- lsof -i@[0:1:2:3:4:5:6:7]
- To find an IP version 6 socket file (when the UNIX dialect
- supports IPv6) by an associated numeric colon-form address
- that has a run of zeroes in it - e.g., the loop-back address
- - use:
- lsof -i@[::1]
+SunOS 5.9 Last change: Revision-4.89 56
- To obtain a repeat mode marker line that contains the
- current time, use:
-SunOS 5.9 Last change: Revision-4.88 56
+Maintenance Procedures LSOF(8)
+ use:
-Maintenance Procedures LSOF(8)
+ lsof -i@[0:1:2:3:4:5:6:7]
+
+ To find an IP version 6 socket file (when the UNIX dialect
+ supports IPv6) by an associated numeric colon-form address
+ that has a run of zeroes in it - e.g., the loop-back address
+ - use:
+ lsof -i@[::1]
+ To obtain a repeat mode marker line that contains the
+ current time, use:
lsof -rm====%T====
The support for /proc file systems is available only for BSD
and Tru64 UNIX dialects, Linux, and dialects derived from
- SYSV R4 - e.g., FreeBSD, NetBSD, OpenBSD, Solaris, UnixWare.
- Some /proc file items - device number, inode number, and
- file size - are unavailable in some dialects. Searching for
- files in a /proc file system may require that the full path
- name be specified.
- No text (txt) file descriptors are displayed for Linux
- processes. All entries for files other than the current
- working directory, the root directory, and numerical file
- descriptors are labeled mem descriptors.
- Lsof can't search for Tru64 UNIX named pipes by name,
- because their kernel implementation of lstat(2) returns an
+SunOS 5.9 Last change: Revision-4.89 57
-SunOS 5.9 Last change: Revision-4.88 57
+Maintenance Procedures LSOF(8)
-Maintenance Procedures LSOF(8)
+ SYSV R4 - e.g., FreeBSD, NetBSD, OpenBSD, Solaris, UnixWare.
+ Some /proc file items - device number, inode number, and
+ file size - are unavailable in some dialects. Searching for
+ files in a /proc file system may require that the full path
+ name be specified.
+ No text (txt) file descriptors are displayed for Linux
+ processes. All entries for files other than the current
+ working directory, the root directory, and numerical file
+ descriptors are labeled mem descriptors.
+ Lsof can't search for Tru64 UNIX named pipes by name,
+ because their kernel implementation of lstat(2) returns an
improper device number for a named pipe.
Lsof can't report fully or correctly on HP-UX 9.01, 10.20,
Frequently-asked questions and their answers (an FAQ) are
available in the 00FAQ file of the lsof distribution.
- That file is also available via anonymous ftp from
- lsof.itap.purdue.edu at pub/tools/unix/lsofFAQ. The URL is:
-
- ftp://lsof.itap.purdue.edu/pub/tools/unix/lsof/FAQ
-FILES
- /dev/kmem kernel virtual memory device
- /dev/mem physical memory device
+SunOS 5.9 Last change: Revision-4.89 58
- /dev/swap system paging device
- .lsof_hostname lsof's device cache file (The suffix,
-SunOS 5.9 Last change: Revision-4.88 58
+Maintenance Procedures LSOF(8)
+ That file is also available via anonymous ftp from
+ lsof.itap.purdue.edu at pub/tools/unix/lsofFAQ. The URL is:
+ ftp://lsof.itap.purdue.edu/pub/tools/unix/lsof/FAQ
-Maintenance Procedures LSOF(8)
+FILES
+ /dev/kmem kernel virtual memory device
+ /dev/mem physical memory device
+ /dev/swap system paging device
+ .lsof_hostname lsof's device cache file (The suffix,
hostname, is the first component of the
host's name returned by gethostname(2).)
AUTHORS
- Lsof was written by Victor A. Abell <abe@purdue.edu> of Pur-
+ Lsof was written by Victor A.Abell <abe@purdue.edu> of Pur-
due University. Many others have contributed to lsof.
They're listed in the 00CREDITS file of the lsof distribu-
tion.
README.lsof_<version> and the other 00* files of the distri-
bution before sending questions to the author.
+
+
+
+SunOS 5.9 Last change: Revision-4.89 59
+
+
+
+
+
+
+Maintenance Procedures LSOF(8)
+
+
+
SEE ALSO
Not all the following manual pages may exist in every UNIX
dialect to which lsof has been ported.
-SunOS 5.9 Last change: Revision-4.88 59
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+SunOS 5.9 Last change: Revision-4.89 60
projects / platform / upstream / lsof.git / commitdiff