搜索关键字:
- linux lsof search by filename
参考内容:
很早之前我就听说过lsof命令,也尝试着去学习使用,但记得在碰到了几个没法解释的问题之后我就放弃了学习,现在因为又碰到了(发现在StackOverflow上也有人碰到了和我之前碰到的类似的问题),就再看看:
I’m using linux mint 13 xfce and I have a file named named wv.gold that I’m trying to check in bash if it’s open by any program (for instance, I opened it in sublime-text and gedit)
In many forums people say that if I run lsof | grep filename I should get 0 if it’s open or 256(1) if it’s closed, but in fact I get nothing (empty string) if I run using grep “wv.gold”, and get a little list if I do it using grep gold.
The list is something like:
bash 2045 user cwd DIR 8,1 4096 658031 /home/user/path/to/dir bash 2082 user cwd DIR 8,1 4096 658031 /home/user/path/to/dir watch 4463 user cwd DIR 8,1 4096 658031 /home/user/path/to/dir gedit 16679 user cwd DIR 8,1 4096 658031 /home/user/path/to/dir lsof 20823 user cwd DIR 8,1 4096 658031 /home/user/path/to/dir grep 20824 user cwd DIR 8,1 4096 658031 /home/user/path/to/dir lsof 20825 user cwd DIR 8,1 4096 658031 /home/user/path/to/dir
Thus, I get the path to the directory it is but NOT the path to the file (there are other files there) and either way only to gedit process, not to sublime-text process.(可以看到gedit,但看不到sublime-text进程)
Is there some easy way to see if a txt file is opened by any other program?
EDIT: It turns out (cf. comments from @mata and @ctn) that some editors load files and close them immediately, and they just reopen the file when saving it. This way, we can only see it when they are still opening a big file (since you have the time to observe it while opening) and it disappears immediately after that.(因为某些编辑器在加载了文件之后立即关闭fd,当需要保存的时候才会再次打开。因此我们只有在打开非常大的文件时才会看到对应的fd,在打开了之后就看不到了。)
==
另外一个查看方式就是——已知进程ID,然后通过/proc文件系统进行查看:
- ls -l /proc/<pid>/fd
- ls -l /proc/<pid>/fdinfo
==
$ lsof /path/to/filename $ lsof | grep filename $ lsof -p <PID> $ lsof -u<login> or $ lsof -u<User ID number> $ lsof -u ^root or $ lsof -u ^0
==
#!/bin/bash lsof <file_system_name> > /dev/null 2>&1 if test $? -eq 0; then echo "<file_system_name> may have no users." else echo "<file_system_name> has some users." fi
==
参考链接:
- http://stackoverflow.com/questions/17321930/check-if-file-is-open-with-lsof #解惑
- http://linux.die.net/man/8/lsof #手册
- http://www.akadia.com/services/lsof_quickstart.txt
- http://unix.stackexchange.com/questions/60422/how-to-interpret-this-output-of-lsof-command #对lsof命令输出的解释
- http://www.ibm.com/developerworks/aix/library/au-lsof.html #全面
- http://www.tecmint.com/10-lsof-command-examples-in-linux/ #样例
- https://danielmiessler.com/study/lsof/
- http://www.thegeekstuff.com/2012/08/lsof-command-examples/
《 “Linux的lsof命令学习” 》 有 3 条评论
查找反弹shell的一个方法:
一般来说bash(sh)是不会有网络链接的,所以有网络连接的bash一定是有问题,所以可以通过:
`
lsof -u root | egrep “ESTABLISHED|SYN_SENT|LISTENING”
lsof -u www-data | egrep “ESTABLISHED|SYN_SENT|LISTENING”
`
来查看是否有对外的连接就可以了。HIDS也可以用这种方法来写报警策略。
https://www.novell.com/coolsolutions/tip/18078.html
https://www.tecmint.com/10-lsof-command-examples-in-linux/
`
# lsof -i #列出所有网络状态为‘LISTENING & ESTABLISHED’的连接信息
# lsof -i TCP #列出所有网络状态为‘LISTENING & ESTABLISHED’的TCP连接信息
# lsof -i TCP:80 #列出所有TCP的80端口的连接信息
# lsof -i TCP:1-1024 #列出所有TCP的1-1024端口之间的连接信息
# lsof -i [email protected].0.2:636 #列出连接到192.168.0.2的LDAP的信息
# lsof -c mysql #列出命令字符串中包含mysql关键字的连接信息
# lsof -i 4 #只列出 IPv4 协议的连接信息
# lsof -i 6 #只列出 IPv6 协议的连接信息
`
一个现代的Linux系统可以拥有的开放TCP连接的理论最大数量是多少
https://stackoverflow.com/questions/2332741/what-is-the-theoretical-maximum-number-of-open-tcp-connections-that-a-modern-lin
`
一个监听端口可以同时接收多个连接。每一个连接通过socket套接字(sip:sport-dip:dport)来进行区分。
所以真正的限制是文件描述符。每个套接字连接都被给定一个文件描述符,因此这个限制实际上是系统配置的文件描述符的数量,从而允许和资源处理。最大的限制通常超过300K,但是是可配置的,例如使用sysctl。
`
检查Linux中给定进程的开放FD限制
https://stackoverflow.com/questions/1356675/check-the-open-fd-limit-for-a-given-process-in-linux
`
/proc/$pid/fd/
/proc/$pid/limits
`
获得最高分配的文件描述符
https://stackoverflow.com/questions/899038/getting-the-highest-allocated-file-descriptor
`
sysconf(_SC_OPEN_MAX)
`
如何在unix系统中关闭另一个进程的文件描述符
https://stackoverflow.com/questions/323146/how-to-close-a-file-descriptor-from-another-process-in-unix-systems
`
gdb
Linux内核模块编程
`
Linux:找出使用了多少文件描述符
https://www.cyberciti.biz/tips/linux-procfs-file-descriptors.html
`
# lsof | wc -l
# sysctl fs.file-nr
`