用途
列出进程已打开的文件，文件可以是常规文件，特殊文件，目录，socket，设备，共享库等。如果不带参数，lsof显示所有进程打开的所有文件。
用法
lsof [ -?abChlnNOPRtUvVX ] [ -A A ] [ -c c ] [ +c c ] [ +|-d d ] [ +|-D D ] [ +|-e s ] [ +|-f
[cfgGn] ] [ -F [f] ] [ -g [s] ] [ -i [i] ] [ -k k ] [ +|-L [l] ] [ +|-m m ] [ +|-M ] [ -o [o] ] [ -p
s ] [ +|-r [t[m<fmt>]] ] [ -s [p:s] ] [ -S [t] ] [ -T [t] ] [ -u s ] [ +|-w ] [ -x [fl] ] [ -z [z] ]
[ -Z [Z] ] [ -- ] [names]
常用选项
-?, -h
显示帮助信息
-a
过滤选项是与的关系，也就是说，所有条件都需要满足
-c c
只输出结果以指定字符串开头的记录，如果字符串签名是^开头表示取反，如果是这样的格式：/xx/修饰符，表示是正则模式
+c w
设置命令名称显示的最大长度，系统规定的最大大小是15，超过了会截取掉，不够的部分使用空格填充
+d s
输出打开文件完整目录路径是s的记录
-d s
根据文件描述符过滤记录，多个使用英文逗号分隔；^开头表示取反；支持数字范围；
+D D
输出包含目录D的记录，部分包含也会输出
-i [i]
This option selects the listing of files any of whose Internet address matches the address specified in i. If no address is specified, this option selects the listing of all Internet and x.25 (HP-UX) network files.
#格式
[46][protocol][@hostname|hostaddr][:service|port]
46 specifies the IP version, IPv4 or IPv6
that applies to the following address.
’6’ may be be specified only if the UNIX
dialect supports IPv6. If neither ’4’ nor
’6’ is specified, the following address
applies to all IP versions.
protocol is a protocol name - TCP, UDP
hostname is an Internet host name. Unless a
specific IP version is specified, open
network files associated with host names
of all versions will be selected.
hostaddr is a numeric Internet IPv4 address in
dot form; or an IPv6 numeric address in
colon form, enclosed in brackets, if the
UNIX dialect supports IPv6. When an IP
version is selected, only its numeric
addresses may be specified.
service is an /etc/services name - e.g., smtp -
or a list of them.
port is a port number, or a list of them.
-l
用户id不转换为用户名(加了这个参数，不知道为啥都是0 _)
-n
This option inhibits the conversion of network numbers to host names for network files. Inhibiting conversion may make lsof run faster. It is also useful when host name lookup is not working properly.
-p s
根据进程id过滤，多个使用英文逗号隔开
--
表示选项已结束，后面的是参数
参数
names
打开的文件名（完整路径）
实践
1 显示所有打开的文件
[root@vm ~]# lsof
2 list all open Internet, x.25 (HP-UX), and UNIX domain files
[root@vm ~]# lsof -i -U
3 list all open IPv4 network files in use by the process whose PID is 1234
[root@vm ~]# lsof -i 4 -a -p 1234
4 list only open IPv6 network files
[root@vm ~]# lsof -i 6
5 list all files using any protocol on ports 513, 514, or 515 of host wonderland.cc.purdue.edu
[root@vm ~]# lsof -i @wonderland.cc.purdue.edu:513-515
6 list all files using any protocol on any port of mace.cc.purdue.edu
[root@vm ~]# lsof -i @mace
7 list all open files for login name ‘‘abe’’, or user ID 1234, or process 456, or process 123, or process 789
[root@vm ~]# lsof -p 456,123,789 -u 1234,abe
8 list all open files on device /dev/hd4
[root@vm ~]# lsof /dev/hd4
9 find the process that has /u/abe/foo open
[root@vm ~]# lsof /u/abe/foo
10 send a SIGHUP to the processes that have /u/abe/bar open
[root@vm ~]# kill -HUP 'lsof -t /u/abe/bar'
参考资料
【1】man lsof