lsof & pwdx

What is lsof?

lsof is a linux command listed current open files.

Open files in the system include disk files, named pipes, network sockets and devices opened by all processes.

$ lsof |head -10

COMMAND     PID   TID              USER   FD      TYPE             DEVICE   SIZE/OFF       NODE NAME
systemd       1                    root  cwd       DIR              253,0       4096        128 /
systemd       1                    root  rtd       DIR              253,0       4096        128 /
systemd       1                    root  txt       REG              253,0    1498184   51139391 /usr/lib/systemd/systemd
systemd       1                    root  mem       REG              253,0      20032   33597713 /usr/lib64/libuuid.so.1.3.0
systemd       1                    root  mem       REG              253,0     252696   33598486 /usr/lib64/libblkid.so.1.1.0

Understanding output of lsof command:

COMMAND: Command using the file.
PID: PID of the file
USER: Owner of the file
FD: File descriptor. Different flags of File descriptor are as below:

#    :  The number in front of flag(s) is the file descriptor number used by the process to associate with the file
u    :  File open with Read and Write permission
r    :  File open with Read permission
w    :  File open with Write permission
W    :  File open with Write permission and with Write Lock on entire file
mem  :   Memory mapped file, usually for shared library

TYPE: File type. Different flags of File type are as below:
REG - Regular file
DIR - Directory

DEVICE: major, minor number of the device where file resides.
SIZE/OFF: File size
NODE: inode number
NAME: File name

When to use lsof?

One use for this command is when a disk can't be unmounted because files are in use.

• Finding info on particular process

# lsof -p # you can use ps aux to display process first.

• Find process opened by users

# lsof -u #

• Find files opened by a process

# lsof -c #

• show listen address

lsos -i [46][protocol][@hostname|hostaddr][:service|port]

Note that this command only be executed by root user will have output.

@ The @ character, leading the host specification, is always required;

: : leading the port specification.

Example1: lsof -i:80 -nP # show the processes listening the port 80.

Example2: lsof -i -n -P #

-i Lists IP sockets.

-n Do not resolve hostnames (no DNS).

-P Do not resolve port names (list port number instead of its name).

pwdx

查看进程目录（查看线程工作目录）

pwdx:　report current working directory of a process

example:

[root@localhost huangyaohong]# pwdx 2611
2611: /var/lib/mysql

组合使用a：

1.ps aux查看进程；

2.pwdx 进程ID;

组合使用b：

1.lsof -i :1521查看哪个进程在使用1521端口；

2.pwdx 进程ID;

组合使用c-查看哪个进行在使用某端口：

1.netstat -ano查看端口情况;

2.lsof -i :<端口号>得到进程ID;

3.pwdx进程ip