Hi, this is Sandra Henry-Stocker, author of the “Unix as a Second Language” blog on NetworkWorld.
In this Linux tip, we’re going to look at the lsof (list open files) command. You might be in for a surprise.
To properly list all open files, you should use sudo. Otherwise you’re likely to run into a lot of Permission Denied warnings.
Unless you’re the best speed reader ever, you probably didn’t catch much of that. There are a LOT of files open on the system. This doesn’t mean that these files are being edited, but that they’re being used. You can pass the output from lsof to more and page down the output one screen at a time if you want, but that’s going to take you quite a while. Let’s use wc to get a feel for how much data the command is spitting out at us.
You may see well over 30,000 open files!
A more practical example is to look at the files open by one particular user.
We still get a lot of output – the files that are open to support this user’s login session (not that the user opened intentionall) and let me add that this user is simply logged in using Putty and editing a single file.
Look at the top line in the lsof output and you’ll see what each field in the output represents – the command or process, process ID and username. Under FD, cwd=current working directory, rtd=root directory, txt=text file, and mem=memory-mapped file. TYPE = whether each entry represents a directory or file, device IDs, sizes, node and eventually the name. If nemo were editing a file, you would see a file name, but “myfile” would be listed as /.myfile.swp because it hasn’t yet been saved.
That’s your Linux tip for lsof. If you have questions or would like to suggest a topic, please add a comment below. And don’t forget to subscribe to the IDG Tech(talk) channel on YouTube.
If you liked this video, please hit the like and share buttons. For more Linux tips, be sure to follow us on Facebook, YouTube and NetworkWorld.com.
