Server Fault Stack Exchange
Server Fault Stack Exchange

Questions tagged [lsof]

Lsof is a tool to list opened files by processes

Lsof is a tool to list on its standard output file information about files opened by processes.

102 questions
2
votes
2 answers

tracking down what files are causing io activity in iostat

Using iostat -Nkx 1 I can see that I am getting regular IO on a volume group. What I'm trying to do is find a way to link that IO to a file/pipe/whatever to see what process is creating this IO and what destination it's hitting. Has anyone come…
Khushil
  • 553
  • 3
  • 11
2
votes
1 answer

Tracking down an elusive and slow anon_inode from lsof and Apache strace

Experiencing an intermittent issue with a LAMP application wherein Apache forks to its ServerLimit and grinds to a (near) halt. An strace on any httpd process shows numerous, slow epoll_wait calls. 1.254721 epoll_wait(14, {{EPOLLIN, ... 3.296430…
Metric Scantlings
  • 141
  • 1
  • 4
2
votes
3 answers

Unexplicated ssh connection from localhost through sshd to random localhost's port

I've tried to find out why I had some strange connections on my secure log file. Something like this : Apr 23 11:35:43 li192-61 sshd[11651]: Did not receive identification string from 127.0.0.1 Apr 23 11:35:49 li192-61 sshd[11661]: Connection closed…
alexgindre
  • 25
  • 1
  • 6
2
votes
4 answers

How to find the program responsible for a specific TCP socket (linux)

joe@server:~$ sudo lsof -i :36168 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME java 23059 activemq 15u IPv6 109382 0t0 TCP *:36168 (LISTEN) From the output above I want to disable port 36168, but don't know where. How…
Joe Nazz
  • 171
  • 1
  • 1
  • 9
1
vote
0 answers

What are the steps to track down a 'too many open files' issue

I'm trying to track down and root cause a 'too many file open' issue on RHEL 7. From googling around, if I run this command it give me the open file count in the first column and the PID in the second column. $ lsof | awk '{print $2}' | sort | uniq…
lifebythedrop
  • 111
  • 3
1
vote
1 answer

Working port invisible to lsof

On Server A CentOS 7, I enabled an iscsi target at portal 192.168.1.101:3260 (that ip is one of A's ips), so that from another Server B I can mount that iscsi target on Server A successfully. From both Server B and Server A I can also do telnet…
John
  • 369
  • 1
  • 4
  • 13
1
vote
1 answer

let lsof shows longer fd length

When I check a process which can use over 10000 file descriptors, lsof only shows 4 digit. (that is it can only show 9999) When over 10000, it start with a asterisk sign. For example: COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE…
neoesque
  • 11
  • 3
1
vote
4 answers

"Logical volume in use" -- cannot remove logical volume

On a Xen 4.8 hypervisor, running on Debian Stretch, I am trying to remove the logical volume of a domU that is no longer used. I stopped the domU and successfully removed the logical volume for the swap file. However, when trying to remove the…
Jonathan Maron
  • 111
  • 1
  • 1
  • 5
1
vote
0 answers

Why is lsof showing these ESTABLISHED ipv6 connections?

I'm trying to track down why a web application is accumulating file descriptors, in the form of connections to clients, even when the clients (browsers) have disconnected. The server is running Ubuntu 14.04. The connections in question typically…
Jens D
  • 121
  • 3
1
vote
3 answers

How can I find out which script/program/user invokes exim (and is sending spam)?

The problem A client of mine asked me to take a look at his shared-hosting webserver for the following problem, but I'm stuck at finding out what's wrong. His server is being blacklisted by a lot of major blocking list such as CBL, Spamhaus and the…
BlueCola
  • 63
  • 1
  • 7
1
vote
1 answer

Detect which scripts are using old interpreters

I have a few Debian machines with some nearly-orphaned script interpreters, for example /bin/bash3 and /usr/bin/perl510. How can I detect those scripts that still have the aforementioned interpreters in their shebang…
Perleone
  • 135
  • 8
1
vote
2 answers

Can I find the list of ports being listened by a process ordered by the time of opening?

I know I can see the list of open ports using the lsof command. I am trying to view the results ordered by timestamp of listening. The process opens multiple (~6) ports and I suspect the order of initialization/binding on that port is the cause of…
rajeshnair
  • 113
  • 5
1
vote
2 answers

Linux: tell if file was opened with O_SYNC

Is there a way to tell if a process opened a file with the O_SYNC flag? I'm thinking lsof might be able to do this, but cannot find a way.
Dave
  • 511
  • 6
  • 15
1
vote
1 answer

lsof displays restored file as deleted

If I create a file named /home/martin/testfile.txt, open this file with less utility, delete /home/martin/testfile.txt file and restore it from file descriptor directory under the /proc/31148, where 31148 is the PID of the less utility, then lsof |…
Martin
  • 332
  • 3
  • 10
  • 28
1
vote
2 answers

How to configure Apache not to keep access.log or error.log open all the time for virtualhosts?

I want to lower number of open files on my VPS. With lsof I noticed that Apache constantly keeps access.log and error.log open for each domain hosted on server. Is there a way to change this behaviour?
Ned-ster
  • 19
  • 1
1 2 3
4
5 6 7