Lsof

Aus Leupers.net-Wiki
Wechseln zu: Navigation, Suche

Troubleshooting

umount problems

In case an unmount command failes, the problem often is that there's still a process accessing something on the device to unmount.

The command 'lsof' (= List Open Files) gives an overview on all files and even sockets opened on the system:

# lsof

If you cannot unmount an USB stick with the name "USBSTICK" you can simply grep for it:

# lsof | grep USBSTICK

The result might look like the following:

bash 3710 leupers cwd DIR 8,17 4096 1 /media/USBSTICK
less 3986 leupers cwd DIR 8,17 4096 1 /media/USBSTICK
less 3986 leupers 4r REG 8,17 1874 192 /media/USBSTICK/info.txt

This tells you that there's not only a 'less' process running, that opened the 'info.txt<code>' file, but there's also a shell ('<code>bash') active where the current working directory ('cwd') is on the USB stick.
=> Terminate the less process and change to another directory (e.g. /media) in the bash; then try 'umount' again.

Alternatively you can also specify the mount point or device name as lsof parameter; e.g.:

# lsof /media/USBSTICK
# lsof /dev/sdb1
# lsof /dev/cdrom
...

Find out who uses what

To find out who uses a certain file, you can specify the filename; e.g.:

# lsof /var/log/messages

To find out which files/sockets are used by a certain process you can specify '-p <PID>' or '-c <ProcessName>'; e.g.:

# lsof -p 1234
# lsof -c less

To find out which files sockets are used by a certain user you can specify '-u <Username>'; e.g.:

# lsof -u leupers

Find out more about socket usage

To find out more about open sockets you can specify '-i (TCP|UDP)'; e.g.:

# lsof -i udp             # show all open UDP sockets
# lsof -i tcp             # show all open TCP sockets
# lsof -i tcp:80          # info about TCP port 80 (http) only
# lsof -i tcp:smtp        # info about TCP port 25 (smtp) only
# lsof -i tcp -n          # print IP addresses instead of hostnames (suppress reverse DNS lookup)

See /etc/services for standard mappings between service names and ports.

Sorted list of listing TCP sockets that accept connections from outside; plain port numbers instead of service names with "-P":

# lsof -i tcp -P | egrep 'COMMAND|LISTEN' | grep -v 'localhost' | sed 's/:/ /g' | sort -nk10 | column -t

Links