实用lsof常用命令行
1, 使用 lsof 命令行列出所有打开的文件
# lsof
这可是一个很长的列表，包括打开的文件和网络
上述屏幕截图中包含很多列，例如 PID、user、FD 和 TYPE 等等。
FD - File descriptor
FD 列包含这样一些值
cwd - Current working directory
txt - Text file
mem - Memory Mapped file
mmap - Memory Mapped device
Number - It represent the actual file descriptor. For example, 0u, 1w and 3r
r 是读的意思，w 是写，u 代表读写
Type 代表文件类型，例如：
>REG - Regular file
>DIR - Directory
>CHR - Character special file
>FIFO - First in first out
2, 列出某个用户打开的文件
# lsof -u user_name
Example:
# lsof -u crybit
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
sshd 29609 crybit cwd DIR 144,233 4096 117711421 /
sshd 29609 crybit rtd DIR 144,233 4096 117711421 /
sshd 29609 crybit txt REG 144,233 409488 119020186 /usr/sbin/sshd
sshd 29609 crybit mem REG 144,241 2443001619 (deleted)/dev/zero (stat: No such file or directory)
sshd 29609 crybit mem REG 8,37 119021850 /lib64/libnss_dns-2.5.so (path dev=144,233)
sshd 29609 crybit mem REG 8,37 119021984 /lib64/security/pam_succeed_if.so (path dev=144,233)
sshd 29609 crybit mem REG 8,37 119022000 /lib64/security/pam_limits.so (path dev=144,233)
sshd 29609 crybit mem REG 8,37 119021960 /lib64/security/pam_keyinit.so (path dev=144,233)
sshd 29609 crybit mem REG 8,37 119021972 /lib64/security/pam_cracklib.so (path dev=144,233)
sshd 29609 crybit mem REG 8,37 119021987 /lib64/security/pam_nologin.so (path dev=144,233)
sshd 29609 crybit mem REG 8,37 119021988 /lib64/security/pam_deny.so (path dev=144,233)
sshd 29609 crybit mem REG 8,37 119019223 /usr/lib64/libcrack.so.2.8.0 (path dev=144,233)
.....
.....
3, 列出在某个端口运行的进程
# lsof -i :port_number
Example:
# lsof -i :22
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
sshd 769 root 3u IPv6 2281738844 0t0 TCP *:ssh (LISTEN)
sshd 769 root 4u IPv4 2281738846 0t0 TCP *:ssh (LISTEN)
# lsof -i :3306
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
mysqld 11106 mysql 10u IPv4 2340975114 0t0 TCP *:mysql (LISTEN)
4, 只列出使用 IPv4 的打开文件
# lsof -i 4 - For IPv4
Example:
# lsof -i 4
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
sshd 769 root 4u IPv4 2281738846 0t0 TCP *:ssh (LISTEN)
named 8362 named 20u IPv4 2334751017 0t0 TCP localhost.localdomain:domain (LISTEN)
named 8362 named 21u IPv4 2334751019 0t0 TCP crybit.com:domain (LISTEN)
named 8362 named 22u IPv4 2334751021 0t0 TCP localhost.localdomain:rndc (LISTEN)
named 8362 named 512u IPv4 2334751016 0t0 UDP localhost.localdomain:domain
named 8362 named 513u IPv4 2334751018 0t0 UDP crybit.com:domain
tcpserver 9975 root 3u IPv4 2335487959 0t0 TCP *:pop3 (LISTEN)
tcpserver 9978 root 3u IPv4 2335487967 0t0 TCP *:pop3s (LISTEN)
tcpserver 9983 root 3u IPv4 2335487997 0t0 TCP *:imap (LISTEN)
tcpserver 9987 root 3u IPv4 2335488014 0t0 TCP *:imaps (LISTEN)
xinetd 10413 root 5u IPv4 2336070983 0t0 TCP *:ftp (LISTEN)
xinetd 10413 root 6u IPv4 2336070984 0t0 TCP *:smtp (LISTEN)
mysqld 11106 mysql 10u IPv4 2340975114 0t0 TCP *:mysql (LISTEN)
# lsof -i 6
Example:
# lsof -i 6
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
sshd 769 root 3u IPv6 2281738844 0t0 TCP *:ssh (LISTEN)
named 8362 named 23u IPv6 2334751024 0t0 TCP localhost.localdomain:rndc (LISTEN)
httpd 29241 root 4u IPv6 2439777206 0t0 TCP *:http (LISTEN)
httpd 29241 root 6u IPv6 2439777211 0t0 TCP *:https (LISTEN)
httpd 29243 apache 4u IPv6 2439777206 0t0 TCP *:http (LISTEN)
httpd 29243 apache 6u IPv6 2439777211 0t0 TCP *:https (LISTEN)
httpd 29244 apache 4u IPv6 2439777206 0t0 TCP *:http (LISTEN)
httpd 29244 apache 6u IPv6 2439777211 0t0 TCP *:https (LISTEN)
httpd 29245 apache 4u IPv6 2439777206 0t0 TCP *:http (LISTEN)
httpd 29245 apache 6u IPv6 2439777211 0t0 TCP *:https (LISTEN)
httpd 29246 apache 4u IPv6 2439777206 0t0 TCP *:http (LISTEN)
5, 列出端口在 1-1024 之间的所有进程
# lsof -i :1-1024
Example:
# lsof -i :1-1024
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
sshd 769 root 3u IPv6 2281738844 0t0 TCP *:ssh (LISTEN)
sshd 769 root 4u IPv4 2281738846 0t0 TCP *:ssh (LISTEN)
named 8362 named 20u IPv4 2334751017 0t0 TCP localhost.localdomain:domain (LISTEN)
named 8362 named 21u IPv4 2334751019 0t0 TCP crybit.com:domain (LISTEN)
named 8362 named 22u IPv4 2334751021 0t0 TCP localhost.localdomain:rndc (LISTEN)
named 8362 named 23u IPv6 2334751024 0t0 TCP localhost.localdomain:rndc (LISTEN)
tcpserver 9975 root 3u IPv4 2335487959 0t0 TCP *:pop3 (LISTEN)
tcpserver 9978 root 3u IPv4 2335487967 0t0 TCP *:pop3s (LISTEN)
tcpserver 9983 root 3u IPv4 2335487997 0t0 TCP *:imap (LISTEN)
tcpserver 9987 root 3u IPv4 2335488014 0t0 TCP *:imaps (LISTEN)
xinetd 10413 root 5u IPv4 2336070983 0t0 TCP *:ftp (LISTEN)
xinetd 10413 root 6u IPv4 2336070984 0t0 TCP *:smtp (LISTEN)
httpd 29241 root 4u IPv6 2439777206 0t0 TCP *:http (LISTEN)
httpd 29241 root 6u IPv6 2439777211 0t0 TCP *:https (LISTEN)
httpd 29243 apache 4u IPv6 2439777206 0t0 TCP *:http (LISTEN)
....
....
6, 根据进程id来列出打开的文件
# lsof -p PID
Example:
# lsof -p 11106
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
mysqld 11106 mysql cwd DIR 144,233 4096 119025114 /var/lib/mysql
mysqld 11106 mysql rtd DIR 144,233 4096 117711421 /
mysqld 11106 mysql txt REG 144,233 9484782 119025094 /usr/libexec/mysqld
mysqld 11106 mysql mem REG 8,37 119025094 /usr/libexec/mysqld (path dev=144,233)
mysqld 11106 mysql mem REG 8,37 119021850 /lib64/libnss_dns-2.5.so (path dev=144,233)
mysqld 11106 mysql mem REG 8,37 119021830 /lib64/libnss_files-2.5.so (path dev=144,233)
mysqld 11106 mysql mem REG 8,37 119021841 /lib64/libsepol.so.1 (path dev=144,233)
mysqld 11106 mysql mem REG 8,37 119021801 /lib64/libselinux.so.1 (path dev=144,233)
mysqld 11106 mysql mem REG 8,37 119021785 /lib64/libresolv-2.5.so (path dev=144,233)
mysqld 11106 mysql mem REG 8,37 119021920 /lib64/libkeyutils-1.2.so (path dev=144,233)
mysqld 11106 mysql mem REG 8,37 119017006 /usr/lib64/libkrb5support.so.0.1 (path dev=144,233)
....
....
7, 杀掉某个用户的所有活动进程
# killall -9 `lsof -t -u username`
8, 列出某个目录中被打开的文件
# lsof +D path_of_the_directory
Example:
# lsof +D /var/log/
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
syslogd 9729 root 1w REG 144,233 0 119019158 /var/log/kernel
syslogd 9729 root 2w REG 144,233 350722 119021699 /var/log/messages
syslogd 9729 root 3w REG 144,233 591577 119019159 /var/log/secure
syslogd 9729 root 4w REG 144,233 591577 119019159 /var/log/secure
9, 根据进程名称列出打开的文件
# lsof -c process_name
Example:
# lsof -c ssh
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
sshd 483 root cwd DIR 8,9 4096 2 /
sshd 483 root rtd DIR 8,9 4096 2 /
sshd 483 root txt REG 8,9 523488 1193409 /usr/sbin/sshd
10, 列出所有网络连接
# lsof -i
该命令列出所有侦听和已建立的网络连接
Example:
# lsof -i
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
sshd 769 root 3u IPv6 2281738844 0t0 TCP *:ssh (LISTEN)
sshd 769 root 4u IPv4 2281738846 0t0 TCP *:ssh (LISTEN)
named 8362 named 20u IPv4 2334751017 0t0 TCP localhost.localdomain:domain (LISTEN)
named 8362 named 21u IPv4 2334751019 0t0 TCP crybit.com:domain (LISTEN)
named 8362 named 22u IPv4 2334751021 0t0 TCP localhost.localdomain:rndc (LISTEN)
named 8362 named 23u IPv6 2334751024 0t0 TCP localhost.localdomain:rndc (LISTEN)
named 8362 named 512u IPv4 2334751016 0t0 UDP localhost.localdomain:domain
就这些！
实用lsof常用命令行的更多相关文章
- lsof 常用命令
lsof 常用命令 原文地址: Lsof 是遵从Unix 哲学的典范,它只做一件事情,并且做的相当完美——它可以列出某个进程打开的所有文件信息.打开的文件可能是普通的文件,目录,NFS文件,块文件 ...
- Linux 常用命令行
Linux常用命令行 第一部分: cd命令 第二部分:文件操作 第三部分:压缩包操作
- vi 常用命令行
vi 常用命令行 1.vi 模式 a) 一般模式: vi 处理文件时,一进入该文件,就是一般模式了. b) 编辑模式:在一般模式下可以进行删除,复制,粘贴等操作,却无法进行编辑操作.等按下‘i,I ...
- GCC常用命令行一览表
GCC常用命令行一览表 这些常用的 gcc/g++ 命令行参数,你都知道么?1. gcc -E source_file.c-E,只执行到预编译.直接输出预编译结果. 2. gcc -S source_ ...
- Linux - 常用命令行（一）
今天和大家分享一些最基本常用命令行:也是作为新手最应该了解掌握的 ls 命令:用来显示指定工作目录下内容 dir命令:与ls命令一致 cd 命令:变化工作目录 pwd命令:显示用户当前的工作路径,显 ...
- HBase表的基本结构和常用命令行操作
一.HBase表的基本结构 1.概述: 平时常见的MySQL.Oracle数据库都是传统型关系数据库,它们都是按行查询.按行存储:而HBase为非关系型数据库,它是按列存储的的. 在HBase插入数据 ...
- Zookeeper常用命令行及API
一.Zookeeper常用命令行 1.启动zookeeper客户端(在启动zookeeper集群后启动进行调试) zkCli.sh 2.查看帮助.操作历史 help.history 3.查看当前Zno ...
- [转]vi 常用命令行
From : http://www.cnblogs.com/sunormoon/archive/2012/02/10/2345326.html vi 常用命令行 1.vi 模式 a) 一般模式: v ...
- (转)Mysql常用命令行
原文:http://www.cnblogs.com/TsengYuen/archive/2012/01/11/2319034.html Mysql常用命令行 Mysql经常使用号令行大全 熬头招.my ...
随机推荐
- HTML快速参考
HTML 模版 html> <head> <meta charset="utf-8"/> <title>html template< ...
- PHP如何让apache支持.htaccess 解决Internal Server Error The server …错误
TP框架 打开 www.newtp.com/index.php/Home/Index/abc出现 如下错误: Internal Server Error The server encountered ...
- docker学习资料整理(持续更新中..)
docker最近可以说火得一踏糊涂,跟 51大神在交流技术的时候这个东西会多次被提到,当我们还玩vm+linux/freebsd的时候,人家已经上升到更高层次了,这就是差距,感觉好高大上的样子,技术之 ...
- BA Practice Lead Handbook 1 - Why Is Business Analysis Taking The World By Storm?
The articles in this series are focused on individual Business Analysts and their managers. https:// ...
- hdu2034java
人见人爱A-B Time Limit: 2000/1000 MS (Java/Others) Memory Limit: 65536/32768 K (Java/Others)Total Submis ...
- thinking in java 读书笔记 --- overriding private method
一个对象可以被用作它自身的类型或者是它的基类类型.当用作它的基类类型时叫做upcasting,如下所示 BaseClass ref = new DerivedClass() //upcasting ...
- oracle数据快速删除
上文说了创建数据还原点的事,数据恢复的前提是我们在删除的时候使用了delete命令来删除,delete在删除的过程中会写日志(所以我们的数据才能够恢复),当然,写日志会导致删除速度变慢.如果我们使用t ...
- Linux下搭建Oracle11g RAC(4)----配置oracle,grid用户SSH对等性
虽然在安装软件的过程中,oracle会自动配置SSH对等性,建议在安装软件之前手工配置. 配置oracle用户对等性: node1: [root@node1 ~]# su - oracle node1 ...
- CentOS 6.7平台Hadoop 1.2.1环境搭建
本教程使用Vultr的VPS搭建,主要实现HDFS和MapReduce两个功能. master.hadoop - 45.32.90.100 slave1.hadoop - 45.32.92.47 sl ...
- Java递归流程
递归二字顾名思义就是:递过去,归回来.所以我索性叫它做有借有还吧. 下面的例子由c而来: public class Main { publ ...