lsof

lsof output file descriptor with asterisk not documented

lsof output file descriptor with asterisk not documented When I run lsof I see the output java 1752736 user 9995u sock 0,8 0t0 1432559505 protocol: TCPv6 java 1752736 user *527u sock 0,8 0t0 1444900878 protocol: TCPv6 What does the * in front of the file descriptor indicate? Asked By: lfmunoz || Source Newer versions of …

Total answers: 1

Have lsof take action if a process has a file open — and, ideally, do so repeatedly

Have lsof take action if a process has a file open — and, ideally, do so repeatedly Per the EXAMPLES section in the lsof(8) man page on manpages.ubuntu.com, I should be able to run a command/take action if a process has a file open: To take action only if a process has /u/abe/foo open, use: lsof /u/abe/foo echo "still in use" When I …

Total answers: 1

how can I list, with lsof command, TCP Established connections ignoring localhost?

how can I list, with lsof command, TCP Established connections ignoring localhost? Using lsof command I would like to print out TCP connections with ESTABLISHED state but ignoring the ones with localhost. I tried: lsof -itcp@^127.0.0.1 -stcp:established lsof -itcp@(^127.0.0.1) -stcp:established lsof -itcp -i ^@127.0.0.1 -stcp:established and others similar, but always getting sintax error response. What …

Total answers: 1

ss doesn't display socket info related to the process opening SOL_SOCKET

ss doesn't display socket info related to the process opening SOL_SOCKET I run a python code inside docker container performing the following calls import socket as s,subprocess as sp;s1=s.socket(s.AF_INET,s.SOCK_STREAM); s1.setsockopt(s.SOL_SOCKET,s.SO_REUSEADDR, 1);s1.bind(("0.0.0.0",9001));s1.listen(1);c,a=s1.accept(); I’m trying to get info using ss and see the open sockets, but can’t get them docker run –rm –publish 9001:9001 -it –name python-app …

Total answers: 1

lsof: WARNING: can't stat() tmpfs file system

lsof: WARNING: can't stat() tmpfs file system when I use lsof as regular user, I get following warnings: lsof: WARNING: can’t stat() tmpfs file system /home/testuser/.cache testuser is another user on my systems, and my own user has no access to the tmpfs filesystem mounted at /home/testuser/.cache. I suspect, lsof found in /etc/fstab (or in …

Total answers: 1

Interacting with Unix Socket found in lsof

Interacting with Unix Socket found in lsof I found a Unix socket being used in the output of the lsof command: COMMAND PID TID TASKCMD USER FD TYPE DEVICE SIZE/OFF NODE NAME screen 110970 username 4u unix 0xffff91fe3134c400 0t0 19075659 socket The "DEVICE" column holds what looks like a memory address. According to the lsof …

Total answers: 1

What does the DEVICE field stand for in lsof?

What does the DEVICE field stand for in lsof? Here is an abridged output of lsof -i tcp:XXXXXX: COMMAND PID USER FD TYPE DEVICE python3 9336 root 3u IPv4 3545328 python3 9336 root 5u IPv4 3545374 Asked By: A.L. Verminburger || Source $ man 8 lsof | grep -A 10 ‘^s{7}DEVICE’ DEVICE contains the device …

Total answers: 1

Are files opened by processes loaded into RAM?

Are files opened by processes loaded into RAM? Commands, for instance sed, are programs and programs are codified logic inside a file and these files are somewhere on the hard disk. However when commands are being run, a copy of their files from the hard disk is put into the RAM, where they come to …

Total answers: 3

Suspicious network activity: sshd process showing up with lsof

Suspicious network activity: sshd process showing up with lsof I have a Raspberry Pi running Debian Jessie. I have pi-hole installed to block ad-serving domains (https://pi-hole.net). Going through the logs, I noticed a lot of queries from a Chinese domain. lsof -i shows me the following list that I feel is suspected: COMMAND PID USER …

Total answers: 3

"netstat -p"/"ss -p" not showing the process of a listening port

"netstat -p"/"ss -p" not showing the process of a listening port On my CentOS 7, at one point, sudo ss -plt listed a port marked as LISTENING on *:30565, but there was no information whatsoever in the process column of its row. The other listening ports were showing their owning process as usual, like users:(("sshd",pid=1381,fd=3)), …

Total answers: 1

Finding the process id by port number

Finding the process id by port number I’m trying (with minimal success at present) to setup the Dovecot mail server on my Fedora 24 server. I’ve installed Dovecot and set the conf file up, all fine. But when I run: systemctl restart dovecot After editing the conf file I get this message Job for dovecot.service …

Total answers: 2

separate lsof output by column

separate lsof output by column I am using this command below and trying to separate the columns I only want to get the PID to use it in my python script. I can easily get this line by line but then how to separate into columns in a non hacky way? I can easily split …

Total answers: 5

How to use lsof to identify incoming TCP connections?

How to use lsof to identify incoming TCP connections? I want to know if my server establishes a connection to a remote server or if the remote server tries to reach my server. I tried to read the output of lsof and obtain this information: lsof -i TCP:25 USER FD TYPE DEVICE SIZE/OFF NODE NAME …

Total answers: 2

What exactly is a file offset in lsof output?

What exactly is a file offset in lsof output? I was using lsof to track down deleted files that were still taking up space and I realized that I wasn’t quite sure what an offset is with respect to a file. lsof‘s man page was less than helpful in this regard and searching around I …

Total answers: 2

Discrepancy with lsof command when trying to get the count of open files per process

Discrepancy with lsof command when trying to get the count of open files per process I am trying to get a list of open files per process. I ran the following one-liner from PerlMonks: lsof | perl -lane ‘$x{“$F[0]:$F[1]”}++; END { print “$x{$_}t$_” for sort {$x{$a}<=>$x{$b}} keys %x}’ It returns the total count of open …

Total answers: 1

log PID of each connection attempt

log PID of each connection attempt Finding the PID of an established connection is trivial using netstat or lsof. However, I have a process which is creating a connection ever 60 seconds to our database and locking it up by maxing out the failed connection attempt limit. I can increase the failed connection limit to …

Total answers: 1

Best way to free disk space from deleted files that are held open

Best way to free disk space from deleted files that are held open Hi I have many files that have been deleted but for some reason the disk space associated with the deleted files is unable to be utilized until I explicitly kill the process for the file taking the disk space $ lsof /tmp/ …

Total answers: 7

Move file but only if it's closed

Move file but only if it's closed I want to move large file created by external process as soon as it’s closed. Is this test command correct? if lsof “/file/name” then # file is open, don’t touch it! else if [ 1 -eq $? ] then # file is closed mv /file/name /other/file/name else # …

Total answers: 2