@donothingsuccessfully The "deleted" tag reported by lsof is Solaris specific, in fact Solaris 10 or later only. The OP did not specify what operating system he is using. @dotancohen On Solaris you can pipe the output of lsof to search for deleted, eg lsof | grep "(deleted)". When there are no more processes holding a deleted file open, the ...

lsof -r 2 -u username The "-r 2" option puts lsof in repeat mode, with updates every 2 seconds. (Ctrl -c quits) The "-u' option can be used to keep an eye on a users activity. If you know the directory name under which the application is being run and do not want to specify the user name,you could use the command like, lsof +D /some/dir -r 2

Most of the time, the best command to use is lsof (“list open files”). lsof +f -- /media/usb0 where /media/usb0 is the mount point of the USB drive or other filesystem to unmount. +f --tells lsof to treat the subsequent argument as a mount point; it usually, but not always, manages on its own, so that lsof /media/usb0 also works. This finds ...

Note that if you have existing filters to lsof, you can use -a to AND them instead of ORing them: lsof -a -i TCP -p 12345. – wchargin Commented Sep 20, 2019 at 0:28

2013年1月6日 · In this scenario I usually use lsof in combination with ps to find out who is holding the device busy. Let's take a example with a usb stick that was mounted as /media/disk-1 $> sudo umount /media/disk-1 [sudo] password for cj: umount: /media/disk-1: device is busy.

2018年5月15日 · $ lsof -F'?' lsof: ID field description a access: r = read; w = write; u = read/write c command name d device character code D major/minor device number as 0x<hex> f file descriptor (always selected) G file flaGs i inode number k link count K task ID (TID) l lock: r/R = read; w/W = write; u = read/write L login name m marker between repeated ...

Take a look at the two outputs. Here are samples from my system. lsof -n -itcp | head -4 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME rpcbind 1509 root 8u IPv4 9013 0t0 TCP *:sunrpc (LISTEN) rpcbind 1509 root 11u IPv6 9016 0t0 TCP *:sunrpc (LISTEN) rpc.statd 1537 statd 8u IPv4 10059 0t0 TCP *:36035 (LISTEN) lsof -n | grep TCP | head -4 …

2021年4月20日 · I compared 'lsof' output after start tomcat instance in two Linux servers. One server return large value (Related to my original question) whereas the second server always return less than 2000. The reason for the issue was having two different versions of 'lsof' in both server. (4.82 and 4.87) Latest version include results related to threads.

lsof /foo | awk 'NR==1 || $4~/[0-9]+[uw]/' These commands should work provided FD is the 4th field in the output and none of the other fields are blank. This is the case for me on Debian when I include a path in the lsof command, however if I don't it prints and extra TID field which is sometimes blank (and will confuse awk).

Another is that lsof takes some time to run, so can miss files that are opened or closed while it's running; therefore the number of listed open files is approximate. Looking at /proc/sys/fs/file-nr gives you an exact value at a particular point in time.