36

How do I tell lsof I need to list only physical files (not sockets, not TCP/IP connections, only physical files)?

Vladislav Rastrusny
  • 2,581
  • 12
  • 39
  • 56
  • First you need to determine what you need it for. To say "physical files" is too general. lsof will give you files that have been opened with a file descriptor. it will give you files that have been opened as memory-mapped files by threads. it will give you library files that have been opened by proceses. all of these are physical files, but the way they are being used is different. – Michael Martinez Apr 08 '17 at 21:01

5 Answers5

43

Just looked through some man pages, it appears you use the command:

sudo lsof /

This will list all open files in the / directory, which is everything on a Linux filesystem. Just tested and it shows only REG and DIR.

More examples:

lsof -a -d 0-999 -c <command name> /
lsof -a -d 0-999 -p <pid> /

0-999 limits it to files with a file descriptor number.

sigjuice
  • 197
  • 1
  • 5
Dave Drager
  • 8,315
  • 28
  • 45
  • 2
    Will include FIFOs as well. – Kyle Brandt Jan 26 '10 at 14:35
  • 1
    Nice and simple. If you need just the last column you could append | awk {'print $9'} Interesting. I don't get fifo in my output either. Fedora 12 and CentOS 5.3 – egorgry Jan 26 '10 at 14:37
  • CentOS 5.2 and Ubuntu 9.04 return the fifo's for me, could be a change, but are you sure there are fifos? I would grep for it first and make sure it is there, than try the `/` – Kyle Brandt Jan 26 '10 at 18:20
  • Also, I was just nitpicking, it sounds like he just doesn't want the noise, and there probably won't be very many fifos. – Kyle Brandt Jan 26 '10 at 18:23
  • 5
    lsof / only includes files on the root filesystem. If you have multiple filesystems mounted, they won't appear in the output. I find the best way is to just use grep. – James Jan 26 '10 at 23:18
  • @James , thanks for the comment, that helped. I was trying to see what files were opened by a bit-torrent client without waiting for the inet entries. With your comment, I did `cat /etc/mtab |awk '{print$2}' | xargs lsof -a -p ` – sargas Feb 18 '13 at 01:02
  • This doesn't work on FreeBSD. – Dan Pritts Apr 20 '13 at 03:58
  • it worked very well also to show only files for specified mounted device – Aquarius Power May 08 '15 at 22:08
  • Shouldn't be considered as the answer to question asked. It displays even unix sockets, for e. g. – poige Jun 04 '17 at 16:17
11

There might be a switch, but if you don't mind filtering it through grep, you could do sudo lsof | egrep 'REG|DIR' , assuming by "physical files" you mean regular files and directories.

See the OUTPUT :: TYPE section of the man page man lsof for all the types that might be in that column.

Kyle Brandt
  • 82,107
  • 71
  • 302
  • 444
3

This is what I did which worked perfectly for me:

lsof -F n -p 12501 | grep ^n/ | cut -c2- | sort -u

The -F n option to lsof will cause it to only print out the names of the open files. Each output line that has the name of an open file will start with the single character n followed immediately by the name. Regular files will always be the absolute, fully-qualified name of the file. The grep ^n/ will select only those lines with a name starting with a / (meaning an absolute, fully-qualified file name); thus eliminating things like open ports, sockets, pipe (like FIFOs), etc. The cut -c2- will eliminate the first character, the n, leaving only the file name. Then finally, the sort -u will eliminate any duplicate entries.

One caveat, this will include files that are not regular as long as their name starts with a /. For example, all files starting with the following would be included:

  • /dev
  • /proc
  • /sys

And there may be others depending on your OS.

Greg Barrett
  • 131
  • 2
2

this works fine on mac os: 

$ lsof /

i like it like this 'cause it's fast. it's faster if you specify -p 

$ lsof -a -p <comma,sep,pids> /
no_ripcord
  • 121
  • 1
2

If you use lsof / it will just list open files on filesystems mounted DIRECTLY under / - that is, if you have /home mounted under /, its contents will be ignored. I tried various combination of options for lsof, but all had problems. The best I could come up is this:

lsof `readlink -f /dev/block/*`

This uses readlink -f to get all block devices and feed them as a list to search. lsof ignores the ones that are not mounted.

If you have any other options to limit the search, for instance a pid, remember to end the lsof command with an -a to AND them with the list of block devices:

lsof -p 982482 -a `readlink -f /dev/block/*`
Horror Vacui
  • 121
  • 1