10

Is their any specific command or tool to get the count of open files by a user in linux?

thanuja
  • 201
  • 1
  • 2
  • 6

2 Answers2

17

lsof -u username will return all the open files for the user. If you pass the result to wc command you will have the count you need. So, if the username of the user is test

lsof -u test | wc -l

dkokmadis
  • 546
  • 2
  • 9
  • I found [this](https://major.io/2007/09/26/counting-open-files-per-user/) old article and executed the "lsof | grep ' user ' | awk '{print $NF}' | sort | wc -l" command as it says. But the output(280000) is hugely different than the output(2000) of your command for the same user. Any reason for this? – thanuja Aug 16 '17 at 13:18
  • What is the username of your user? if the username is for example `a` the command `lsof | grep a ` will match all the lines that have a, so the result will not be correct. – dkokmadis Aug 16 '17 at 13:21
  • The user name is same for the both command. I used `lsof | grep ' root ' | awk '{print $NF}' | sort | wc -l` and `lsof -u root | wc -l` commands. – thanuja Aug 16 '17 at 13:27
  • The grep command will not return accurate results because it will match more results that contain "username" in it. It will match for example all the /proc/*/root files. if you want to use a different command you can use `lsof | tr -s ' ' | cut -d ' ' -f3 | grep username | wc -l` – dkokmadis Aug 18 '17 at 11:06
3

you can use lsof. this command is for find out what processes currently have the file open. if process opening the file, writing to it, and then closing it you can use auditing.

 /sbin/auditctl -w /etc/myprogram/cofig.ini -p war -k config.ini-file

-w watch etc/myprogram/cofig.ini -p warx watch for write, attribute change, execute or read events -k config.ini-file is a search key. wait till the file change then use

 /sbin/ausearch -f /etc/myprogram/cofig.ini | more
omid abbasi
  • 131
  • 4