lsof

In 1985, Cliff Spencer publishes the {{code|ofiles}} command. Its man page says: "ofiles – who has a file open [...] displays the owner and id of any process accessing a specified device". Spencer compiled it for 4.2BSD and ULTRIX.{{cite web |last1=Spencer |first1=Cliff |title=ofiles(8) |url=https://groups.google.com/g/net.sources/c/L82MvsQrnoA/m/LOADevFckCkJ |website=groups.google.com |publisher=net.sources |access-date=2023-04-13 |archive-date=2023-04-13 |archive-url=https://web.archive.org/web/20230413052716/https://groups.google.com/g/net.sources/c/L82MvsQrnoA/m/LOADevFckCkJ |url-status=live }} Moreover, in the newsgroup net.unix-wizards, he further remarks:{{cite web |last1=Spencer |first1=Cliff |title="ofiles" posted to net.sources |url=https://groups.google.com/g/net.unix-wizards/c/UyTm4kUMMDE/m/NzIh78IWdXkJ |website=groups.google.com |publisher=net.unix-wizards |access-date=2023-04-13 |archive-date=2023-04-13 |archive-url=https://web.archive.org/web/20230413052718/https://groups.google.com/g/net.unix-wizards/c/UyTm4kUMMDE/m/NzIh78IWdXkJ |url-status=live }}

With all the chatter about dismounting active file systems,

I have posted my program to indicate who is using

a particular filesystem, "ofiles" to net.sources.

In 1988, the command {{code|fstat}} ("file status") appears as part of the 4.3BSD-Tahoe release. Its man page says:{{cite web |url=https://www.tuhs.org/cgi-bin/utree.pl?file=4.3BSD-Tahoe/usr/man/cat8/fstat.0 |website=www.tuhs.org |title=FSTAT(8) |publisher=4.3BSD-Tahoe}}

fstat identifies open files. A file is considered open if a

process has it open, if it is the working directory for a

process, or if it is an active pure text file. If no

options are specified, fstat reports on all open files.

In 1989, in comp.sources.unix, Vic Abell publishes ports of the ofiles and fstat commands from 4.3BSD-Tahoe to "DYNIX

3.0.1[24] for Sequent Symmetry and Balance, SunOS 4.0 and ULTRIX 2.2".{{cite web |url=https://sources.vsta.org/comp.sources.unix/volume18/ofiles.new |title=v18i057: REVISED ofiles, doesn't need Sun source |publisher=comp.sources.unix}}{{cite web |url=https://sources.vsta.org/comp.sources.unix/volume18/fstat2 |title=v18i107: Show all open files status |publisher=comp.sources.unix}} Various people had evolved and ported ofiles over the years. Abell contrasted the commands as follows:{{r|fstat}}

Fstat is similar to the ofiles program which I recently submitted. Like

ofiles, fstat identifies open files. It's orientation differs slightly

from that of ofiles: ofiles starts with a file name and paws through the

proc and user structures to identify the file; fstat reads all the proc

and user structures, displaying information in all files, optionally

applying a few filters to the output (including a single file name filter.)

In combination with netstat -aA and grep, fstat will identify the process

associated with a network connection, just as will ofiles.

In 1991, Vic Abell publishes lsof version 1.0 to comp.sources.unix. He notes:{{cite web |url=https://sources.vsta.org/comp.sources.unix/volume25/lsof |title=v25i002: lsof - a successor to fstat and ofiles |publisher=comp.sources.unix |access-date=2023-04-13 |archive-date=2023-01-10 |archive-url=https://web.archive.org/web/20230110165833/https://sources.vsta.org/comp.sources.unix/volume25/lsof |url-status=live }}

Lsof (for LiSt Open Files) lists files opened by processes on selected

Unix systems. It is my answer to those who regularly ask me when I am

going to make fstat (comp.sources.unix volume 18, number 107) or ofiles

(volume 18, number 57) available on SunOS 4.1.1 or the like.

Lsof is a complete redesign of the fstat/ofiles series, based on the SunOS

vnode model. Thus, it has been tested on AIX 3.1.[357], HP-UX [78].x,

NeXTStep 2.[01], Sequent Dynix 3.0.12 and 3.1.2, and Sunos 4.1 and 4.1.1.

Using available kernel access methods, such as nlist() and kvm_read(),

lsof reads process table entries, user areas and file pointers to reach

the underlying structures that describe files opened by processes.

In 2018, Vic Abbell publishes lsof version 4.92. The same year, he initiates the transfer of responsibility. He writes:{{cite web |title=lsof has moved to GitHub and has a new release · Issue #39572 · Homebrew/homebrew-core |url=https://github.com/Homebrew/homebrew-core/issues/39572#issuecomment-490877044 |website=GitHub |language=en |access-date=2023-04-13 |archive-date=2023-04-13 |archive-url=https://web.archive.org/web/20230413052713/https://github.com/Homebrew/homebrew-core/issues/39572#issuecomment-490877044 |url-status=live }}

I will reach 80 years of age later this year and I think it's time for me to end my work on general lsof revision releases.

The lsof code is put on Github and maintenance is transferred.{{r|gh1}}{{cite web |title=lsof maintaining.md |url=https://github.com/lsof-org/lsof/blob/master/docs/maintaining.md |website=GitHub |publisher=lsof-org |date=10 April 2023 |access-date=13 April 2023 |archive-date=13 April 2023 |archive-url=https://web.archive.org/web/20230413052714/https://github.com/lsof-org/lsof/blob/master/docs/maintaining.md |url-status=live }}

Open files in the system include disk files, named pipes, network sockets and devices opened by all processes. One use for this command is when a disk cannot be unmounted because (unspecified) files are in use. The listing of open files can be consulted (suitably filtered if necessary) to identify the process that is using the files.

1. lsof /var

COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME

syslogd 350 root 5w VREG 222,5 0 440818 /var/adm/messages

syslogd 350 root 6w VREG 222,5 339098 6248 /var/log/syslog

cron 353 root cwd VDIR 222,5 512 254550 /var -- atjobs

To view the port associated with a daemon:

1. lsof -i -n -P | grep sendmail

sendmail 31649 root 4u IPv4 521738 TCP *:25 (LISTEN)

From the above one can see that "sendmail" is listening on its standard port of "25".

;{{mono|-i}}: Lists IP sockets.

;{{mono|-n}}: Do not resolve hostnames (no DNS).

;{{mono|-P}}: Do not resolve port names (list port number instead of its name).

One can also list Unix Sockets by using lsof -U.

The lsof output describes:

• the identification number of the process (PID) that has opened the file;
• the process group identification number (PGID) of the process (optional);
• the process identification number of the parent process (PPID) (optional);
• the command the process is executing;
• the owner of the process;
• for all files in use by the process, including the executing text file and the shared libraries it is using:
• the file descriptor number of the file, if applicable;
• the file's access mode;
• the file's lock status;
• the file's device numbers;
• the file's inode number;
• the file's size or offset;
• the name of the file system containing the file;
• any available components of the file's path name;
• the names of the file's stream components;
• the file's local and remote network addresses;
• the TLI network (typically UDP) state of the file;
• the TCP state, read queue length, and write queue length of the file;
• the file's TCP window read and write lengths (Solaris only); and
• other file or dialect-specific values.

For a complete list of options, see the Lsof(8) Linux manual page.{{cite web |url=https://man7.org/linux/man-pages/man8/lsof.8.html |title=lsof| accessdate=16 July 2020}}

• fuser (Unix)
• stat (Unix)
• netstat
• strace
• List of Unix commands

{{Reflist}}

• [http://people.freebsd.org/~abe/ Old site]
• [https://lists.purdue.edu/mailman/listinfo/lsof-l lsof-l mailing list]
• [http://ftp.mirrorservice.org/sites/lsof.itap.purdue.edu/pub/tools/unix/lsof/ mirror of legacy sources]
• {{man|8|lsof|die.net}}
• {{man|8|lsof|Darwin}}
• [http://danielmiessler.com/study/lsof Using lsof]
• [http://ftp.mirrorservice.org/sites/lsof.itap.purdue.edu/pub/tools/unix/lsof/FAQ Lsof FAQ]
• Sam Nelson's [https://web.archive.org/web/20070509052951/http://www.unix.ms/pcp/ PCP] script, an alternative to "lsof -i" for Solaris.
• [http://glsof.sourceforge.net/ Glsof] is two separate utilities (Queries and Filemonitor) based on lsof.
• [http://github.com/sveinbjornt/Sloth Sloth] is a macOS graphical interface for lsof
• [https://netadmintools.com/html/lsof.man.html Manpage of LSOF]

{{Unix commands}}

Category:Unix file system-related software