Linux的lsof命令学习


搜索关键字:

  • linux lsof search by filename

参考内容:

很早之前我就听说过lsof命令,也尝试着去学习使用,但记得在碰到了几个没法解释的问题之后我就放弃了学习,现在因为又碰到了(发现在StackOverflow上也有人碰到了和我之前碰到的类似的问题),就再看看:

I’m using linux mint 13 xfce and I have a file named named wv.gold that I’m trying to check in bash if it’s open by any program (for instance, I opened it in sublime-text and gedit)

In many forums people say that if I run lsof | grep filename I should get 0 if it’s open or 256(1) if it’s closed, but in fact I get nothing (empty string) if I run using grep “wv.gold”, and get a little list if I do it using grep gold.

The list is something like:

bash       2045  user   cwd   DIR   8,1     4096     658031 /home/user/path/to/dir
bash       2082  user   cwd   DIR   8,1     4096     658031 /home/user/path/to/dir
watch      4463  user   cwd   DIR   8,1     4096     658031 /home/user/path/to/dir
gedit     16679  user   cwd   DIR   8,1     4096     658031 /home/user/path/to/dir
lsof      20823  user   cwd   DIR   8,1     4096     658031 /home/user/path/to/dir
grep      20824  user   cwd   DIR   8,1     4096     658031 /home/user/path/to/dir
lsof      20825  user   cwd   DIR   8,1     4096     658031 /home/user/path/to/dir

Thus, I get the path to the directory it is but NOT the path to the file (there are other files there) and either way only to gedit process, not to sublime-text process.(可以看到gedit,但看不到sublime-text进程)

Is there some easy way to see if a txt file is opened by any other program?

EDIT: It turns out (cf. comments from @mata and @ctn) that some editors load files and close them immediately, and they just reopen the file when saving it. This way, we can only see it when they are still opening a big file (since you have the time to observe it while opening) and it disappears immediately after that.(因为某些编辑器在加载了文件之后立即关闭fd,当需要保存的时候才会再次打开。因此我们只有在打开非常大的文件时才会看到对应的fd,在打开了之后就看不到了。)

==

另外一个查看方式就是——已知进程ID,然后通过/proc文件系统进行查看:

  • ls -l /proc/<pid>/fd
  • ls -l /proc/<pid>/fdinfo

==

$ lsof /path/to/filename
$ lsof | grep filename

$ lsof -p <PID>

$ lsof -u<login>
or
$ lsof -u<User ID number>

$ lsof -u ^root
or
$ lsof -u ^0

==

#!/bin/bash
lsof <file_system_name> > /dev/null 2>&1
if test $? -eq 0; then
  echo "<file_system_name> may have no users."
else
  echo "<file_system_name> has some users."
fi

==

参考链接:

, ,

《 “Linux的lsof命令学习” 》 有 3 条评论

  1. 查找反弹shell的一个方法:
    一般来说bash(sh)是不会有网络链接的,所以有网络连接的bash一定是有问题,所以可以通过:
    `
    lsof -u root | egrep “ESTABLISHED|SYN_SENT|LISTENING”
    lsof -u www-data | egrep “ESTABLISHED|SYN_SENT|LISTENING”
    `
    来查看是否有对外的连接就可以了。HIDS也可以用这种方法来写报警策略。

  2. https://www.novell.com/coolsolutions/tip/18078.html
    https://www.tecmint.com/10-lsof-command-examples-in-linux/
    `
    # lsof -i #列出所有网络状态为‘LISTENING & ESTABLISHED’的连接信息
    # lsof -i TCP #列出所有网络状态为‘LISTENING & ESTABLISHED’的TCP连接信息

    # lsof -i TCP:80 #列出所有TCP的80端口的连接信息
    # lsof -i TCP:1-1024 #列出所有TCP的1-1024端口之间的连接信息

    # lsof -i [email protected].0.2:636 #列出连接到192.168.0.2的LDAP的信息

    # lsof -c mysql #列出命令字符串中包含mysql关键字的连接信息

    # lsof -i 4 #只列出 IPv4 协议的连接信息
    # lsof -i 6 #只列出 IPv6 协议的连接信息
    `

  3. 一个现代的Linux系统可以拥有的开放TCP连接的理论最大数量是多少
    https://stackoverflow.com/questions/2332741/what-is-the-theoretical-maximum-number-of-open-tcp-connections-that-a-modern-lin
    `
    一个监听端口可以同时接收多个连接。每一个连接通过socket套接字(sip:sport-dip:dport)来进行区分。
    所以真正的限制是文件描述符。每个套接字连接都被给定一个文件描述符,因此这个限制实际上是系统配置的文件描述符的数量,从而允许和资源处理。最大的限制通常超过300K,但是是可配置的,例如使用sysctl。
    `

    检查Linux中给定进程的开放FD限制
    https://stackoverflow.com/questions/1356675/check-the-open-fd-limit-for-a-given-process-in-linux
    `
    /proc/$pid/fd/
    /proc/$pid/limits
    `

    获得最高分配的文件描述符
    https://stackoverflow.com/questions/899038/getting-the-highest-allocated-file-descriptor
    `
    sysconf(_SC_OPEN_MAX)
    `

    如何在unix系统中关闭另一个进程的文件描述符
    https://stackoverflow.com/questions/323146/how-to-close-a-file-descriptor-from-another-process-in-unix-systems
    `
    gdb
    Linux内核模块编程
    `

    Linux:找出使用了多少文件描述符
    https://www.cyberciti.biz/tips/linux-procfs-file-descriptors.html
    `
    # lsof | wc -l
    # sysctl fs.file-nr
    `

发表回复

您的邮箱地址不会被公开。 必填项已用 * 标注