lsof介绍

lsof（list open files）是一个列出当前系统打开文件的工具。

在linux环境下，任何事物都以文件的形式存在，通过文件不仅仅可以访问常规数据，还可以访问网络连接和硬件。

命令示例

1. 找出谁在使用某个文件

    [root@ns-2 ~]# lsof /var/log/messages
    COMMAND  PID USER   FD   TYPE DEVICE SIZE/OFF     NODE NAME
    rsyslogd 697 root    3w   REG  253,0   504163 69130584 /var/log/messages

2. 递归查找某个目录中所有打开的文件

    [root@ns-2 ~]# lsof +D /usr/local/etc/unbound/
    COMMAND   PID USER   FD   TYPE DEVICE SIZE/OFF      NODE NAME
    unbound 28966 root  cwd    DIR  253,0     4096 134379613 /usr/local/etc/unbound
    unbound 28966 root  rtd    DIR  253,0     4096 134379613 /usr/local/etc/unbound
    unbound 28966 root   21w   REG  253,0  1618157 134358803 /usr/local/etc/unbound/unbound_running.log

3. 列出某个用户打开的所有文件

    [root@ns-2 ~]# lsof -u wuyanteng |more
    sshd    8039 wuyanteng  mem    REG              253,0     15480 134358778 /usr/lib64/security/pam_lastlog.so
    sshd    8039 wuyanteng  mem    REG              253,0     15624 201432150 /usr/lib64/libpam_misc.so.0.82.0
    sshd    8039 wuyanteng  mem    REG              253,0     19600 134358779 /usr/lib64/security/pam_limits.so

4. 查看某个程序打开的所有文件

    [root@ns-2 ~]# lsof -c unbound
    COMMAND   PID USER   FD      TYPE             DEVICE SIZE/OFF      NODE NAME
    unbound 28966 root  cwd       DIR              253,0     4096 134379613 /usr/local/etc/unbound
    unbound 28966 root  rtd       DIR              253,0     4096 134379613 /usr/local/etc/unbound
    unbound 28966 root  txt       REG              253,0  4069713    535415 /usr/local/sbin/unbound

5. 查看某个PID对应的进程打开的文件

    [root@ns-2 ~]# lsof -p 766
    dnscrypt- 766 root  txt       REG              253,0   461231    503249 /usr/local/sbin/dnscrypt-proxy
    dnscrypt- 766 root  mem       REG              253,0    62184 201328501 /usr/lib64/libnss_files-2.17.so
    dnscrypt- 766 root  mem       REG              253,0  2118128 201328482 /usr/lib64/libc-2.17.so

6. 列出所有TCP网络连接

     [root@ns-2 ~]# lsof -i tcp
     COMMAND     PID         USER   FD   TYPE  DEVICE SIZE/OFF NODE NAME
     dnscrypt-   766         root   11u  IPv4   17618      0t0  TCP localhost:mdns (LISTEN)
     sshd        941         root    3u  IPv4     649      0t0  TCP *:ssh (LISTEN)
     sshd        941         root    4u  IPv6     651      0t0  TCP *:ssh (LISTEN)
     dnscrypt-   943         root   11u  IPv4   16020      0t0  TCP localhost:mdns (LISTEN)

7. 列出所有UDP网络连接

     [root@ns-2 ~]# lsof -i udp

     local      7831 postfix   16u  IPv4 2814062      0t0  UDP *:40209 
     yum        8091    root    8u  IPv4 2826722      0t0  UDP bogon:47324->public1.114dns.com:domain 
     unbound   28966    root    3u  IPv4  671972      0t0  UDP bogon:domain 

8. 找到使用某个端口的进程

     [root@ns-2 ~]# lsof -i:10050
     COMMAND   PID         USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
     zabbix_ag 963 zabbix-agent    4u  IPv4  14018      0t0  TCP *:zabbix-agent (LISTEN)
     zabbix_ag 969 zabbix-agent    4u  IPv4  14018      0t0  TCP *:zabbix-agent (LISTEN)
     zabbix_ag 970 zabbix-agent    4u  IPv4  14018      0t0  TCP *:zabbix-agent (LISTEN)

9. 列出ipv4所有进程

     [root@ns-2 ~]# lsof -i 4    //列举出所有ipv4进程

     [root@ns-2 ~]# lsof -i 6    //列举出所有ipv6进程
     COMMAND   PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
     sshd      941 root    4u  IPv6    651      0t0  TCP *:ssh (LISTEN)
     master   1371 root   14u  IPv6   9677      0t0  TCP localhost:smtp (LISTEN)
     unbound 28966 root   19u  IPv6 671988      0t0  TCP localhost:ub-dns-control (LISTEN)