githubmirror/lsof

NEW/lsofAPI/lsofAPI.2
246 строк7 KB
Masatake YAMATO
Import the final source tree published by Vic, the original lsof maintainer.
23 июл 2018, 06:45
23 июл 2018, 06:458662085

			Data lsof reports and where
			     lsof got the data.
	
    COMMAND

	This is the command name from the process or user structure.
	Lsof prints only the first 9 characters.  However, it
	reports all characters in field output.

	Lsof can be told to filter output by the command name via
	its -c option.

    PID

	This is the Process IDentification number from the process
	structure.

	Lsof can be told to filter output by PID number via its -p
	option.

    PPID

	This is the Parent Process IDentification number.

	There is no filter option for PPID.

    PGRP

	This is the Process Group IDentification number.

	Lsof can be told to filter output by PGRP ID via its -g
	option.

    USER

	This is the identification of the user who owns the process.
	Sometimes UID is taken from the p_uid member of the process
	structure and sometimes from the pid struct to which the
	proc structure points.

	User identification is normally reported as a login name,
	but can be reported as a User IDentification number via
	lsof's -l option.

	Lsof can be told to filter by use identification with its
	-u option.

    FD

	Usually this is the file descriptor number, but can have
	some special forms for open files that aren't connected
	to file descriptors:

		cwd	for the current working directory
		rtd	for the root directory
		txt	for text (executable) files occupying
			memory regions
		mem	for other memory-mapped files
		Rxx	for unrecognized region files whose
			p_type is the two digit number xx.

	The file descriptor is followed by two characters: 1) a
	file access mode; and 2) a file lock status.

	The file access mode is 'r' for read; 'w', write; and 'u'
	for read and write.  This information is taken from the
 	f_flag member of the file structure.  Lsof can also be
 	directed to report the contents of f_flag.

	The file lock status is determined by following the lock
	list chain from the vnode.  The first lock encountered in
	the list determine what is reported: 'r' for a read lock
	on part of the file; 'R' for a read lock on the entire
	file; 'w' for a write lock on part of the file; and 'W"
        for a write lock on the entire file.

    TYPE

	Usually this is the type reported in v_type -- e.g., VCHR,
	VDIR, VREG, etc.  However, lsof tries to limit the length
	to four characters, so VFIFO becomes FIFO.

	Lsof also uses the TYPE column to indicate socket files:

	   inet  Internet domain
	   IPv4	 where lsof supports IPv4 and IPv6
	   IPv6	 where lsof supports IPv4 and IPv6
	   sock  unknown domain
	   unix  Unix domain

    FILE-ADDR

	This is the kernel file structure address lsof read from
	the proc structure or file chunks.  It is useful for
	detecting (usually via scripts that post-process lsof field
	output) file descriptors shared between processes -- e.g.,
	inherited by a child from its parent -- especially when
	excessive file descriptor use ("leaks") appear to be
	occurring.

	This item is only reported when selected with lsof's +ff
	option, and when the open file is represented by a file
	descriptor.


    FCT

	This is the f_count member of the file structure.  It is
	useful when chasing file descriptor "leaks" for determining
	how many references a file descriptor has.

	This item is only reported when selected with lsof's +fc
	option, and when the open file is represented by a file
	descriptor.

    NODE-ID

	This is the vnode address from the f_data member of the
	file structure.  It is useful for detecting (usually via
	scripts that post-process lsof field output) files that
	are shared between processes.

	This item is only reported when selected with lsof's +fp
	option, and when the open file is represented by a file
	descriptor.

    DEVICE

	Two things may appear in the device column: 1) the major
	and minor device number doublet of character and block
	devices; or 2) a hexadecimal number that represents the
	"device" of a pipe or socket -- e.g., the TCP/IP protocol
	address also reported by netstat -A.

	There are two reasons for reporting a hex number: 1) to
	match with netstat -A output; and 2) to match a pipe or
	socket whose only destination address is a similar hex
	number.

    SIZE/OFF

	Lsof reports the file size or current position (offset from
	f_offset of the file structure) in this column.

	The default mode is to report offset for files that don't
	have size in their node structures -- e.g., pipes, sockets,
	character device files -- and size from the node structure
	for everything else.

	Several lsof options control what is reported: -o selects
	offset (and suppresses size); -s selects size (and suppresses
	offset); and -o[n] specifies how many offset digits are
	to be reported in decimal (default 8) before the output
	form switches to hexadecimal.

	File size is very useful when a system administrator is
	searching for unlinked files that are still consuming disk
	space.

	File offset is very useful to anyone who is watching for
	activity on a character device file or socket.  I use it
	to measure progress of ftp transfers, for example.

    NLINK

	The file (e.g. inode) link count.  This is usefile for
	locating large unlinked files that are still being written
	and are consuming needed disk space.

	Lsof has a elementary filter for link count.

    NODE

	Usually the value in the NODE column is the associated node
	structure's ID number -- e.g., the inode number.

	However, some open files don't have a node structure.  For
	them lsof uses this column in a variety of ways.

	NODE may contain the protocol (PF_*) value for TCP/IP
	sockets.

	NODE is blank for Unix sockets.

	NODE may contain STR for streams.

    NAME

	The NAME column is the most complicated and overloaded
	output field lsof produces.

	Originally it was designed to receive the node name of
	files attached to device nodes (VCHR) files or the mounted-on
	directory and mounted-on device names for file systems  In
	many cases that information still appears in the NAME column.

	However, along the way the NAME column has become used for
	a wide variety of miscellaneous file information, including:

	*  Error messages about situations lsof has encountered --
	   e.g., it can't read a node structure via /dev/kmem.

	*  Socket file information:

	   o  TCP/IP connection addresses (ports or service names, and
	      host names or IP numbers)

	   o  TCP/IP connection information -- states (e.g., ESTABLISH,
	      or Unbound), received and send queue sizes, receive and
	      send queue window sizes

	   o  FIFO and pipe information -- peer connection ID, data
	      in the pipes

	   o  Unix socket information -- peer connection ID, file
	      system object (i.e., path name)

	   o  The name of a file or file system specified as a search
	      search argument

	   o  NFS mount points

	   o  Stream module names, perhaps accompanied by a device,
	      clone device, or pseudo device name

	   o  Raw socket address information

	   o  Socket pair information

	   o  Namefs (via fattach(3C)) information

	   o  Full and partial path names, anchored at the containing
	      file system and extending through some or all kernel
	      name cache components

	   o  Clone device names

	   o  Pseudo device names

	Of all these NAME column items, file system name, socket
	connection parameters, character device node names, and
	full path names are the most useful.


    Vic Abell <abe@purdue.edu>
    March 16, 1999