previous contents up next

Unix for Advanced Users

15. Advanced Commands and Usage

15.9. List Open Files: lsof and fuser

The function of these commands is very similar. The goal is to determine what processes have certain files open. lsof is freeware and thus freely compilable under all Unixes. It is available by default under Linux only.

The main difference between lsof and fuser is that lsof takes both files/filesystems and PIDs as arguments whereas fuser only accepts files/filesystems.

lsof:

lsof stands for list open files. It lists information about files that are currently open by processes.

In the absence of any options, lsof lists all open files belonging to all active processes

To list all open files for login name ``abe'', or user ID 1234 you would use the -u option. To list files being used by process 456, process 123, or process 789, you would use the -p flag. Putting these criteria together, we would have a command that looks like this:

lsof -p 456,123,789 -u 1234,abe

The command to list all open files on device /dev/hd4, would look like this:

lsof /dev/hd4

To find the process that has /u/abe/foo open, use:

lsof /u/abe/foo

fuser:

fuser is more widely available (under AIX, HP-UX, IRIX, Linux, Solaris, Tru64 UNIX, and others) and can only be run as root. It displays the process ID numbers of processes using the specified files or file systems. In the default display mode, each file name is followed by a letter denoting the type of access (these codes differ from vendor to vendor):

aif the process is using the file as its trace file in /proc (IRIX)
cif the process is using the file as its current directory
eif the process is using the file as the executable being run
fif the process is using the file as an open file (Linux)
mif the process is using the file as a mmaped or shared lib (Linux)
oif the process is using the file as an open file (IRIX, Solaris, Tru64 UNIX))
pif the process is using the file as the parent of its current directory (Tru64 UNIX)
rif the process is using the file as root directory
sif the process is using the file as a shared lib (AIX)
tif the process is using the file as its text file (Solaris)
yif the process is using the file as its controlling terminal (IRIX)

Here is an example of fuser running under Linux:

linux# /usr/sbin/fuser /
/:     1r     1c     2r     2c     3r     3c     4r     4c
252r   252c   275r   275c   286r   286c   300r   314r   328r   328c   342r
342c   356r   356c   374r   374c   385r   385c   396r   396c   411r   411c
412r   412c   413r   413c   414r   414c   415r   415c   416r   416c   417r
417c   418r   418c   419r   419c   420r   420c   455r   470r   470c   485r
485c   500r   500c   538r   538c   539r   539c   540r   540c   541r   541c
542r   542c   543r   543c   544r   544c   546r   546c   548r   548c   551r
551c   556r   569r   591r   597r   610r   612r   614r   614c   618r   626r
628r   636r   646r  7090r  7090c  7092r  7243r  7288r  7288c  7290r  7303r

previous contents up next