lsof -i -tcp | lsof -i :7980 | lsof –u username | lsof -r 10 -c php -a -i :1521 | kill -9 `lsof -t /tmp/obscure.lock`

Show all open connections
 lsof -i
Show LDAP *incoming * connections
lsof -i TCP@192.168.0.1:636 ()  
#java  890 root  18u  IPv6 8332031
#TCP myserver.com:42936 myserver.com:ldaps (ESTABLISHED)
Who uses SMTP?
lsof -i :25  
#COMMAND  PID USER   FD   TYPE        DEVICE SIZE/OFF NODE NAME
#sendmail 401 root    5u  IPv4 0x300023cc141      0t0  TCP *:smtp (LISTEN)
#sendmail 401 root    6u  IPv6 0x3000243c200      0t0  TCP *:smtp (LISTEN)
-c option allows to see what files are open by a particular command.
lsof -c mysq  
lsof -c ruby

List processes which opened a specific file

You can list only the processes which opened a specific file, by providing the filename as arguments.
# lsof /var/log/syslog

COMMAND  PID   USER   FD   TYPE DEVICE SIZE/OFF   NODE NAME
rsyslogd 488 syslog    1w   REG    8,1     1151 268940 /var/log/syslog

Similarly you can also use ‘-t’ in many ways. For example, to list process id of a process which opened /var/log/syslog can be done by

# lsof -t /var/log/syslog

489

List processes using a mount point

Sometime when we try to umount a directory, the system will say “Device or Resource Busy” error. So we need to find out what are all the processes using the mount point and kill those processes to umount the directory. By using lsof we can find those processes.
# lsof /home
The following will also work.
# lsof +D /home/

List all open files by a specific process

You can list all the files opened by a specific process using ‘-p’ option. It will be helpful sometimes to get more information about a specific process.
# lsof -p 1753

COMMAND  PID       USER   FD   TYPE DEVICE SIZE/OFF    NODE NAME
bash    1753 lakshmanan  cwd    DIR    8,1     4096  393571 /home/lakshmanan/test.txt
bash    1753 lakshmanan  rtd    DIR    8,1     4096       2 /
bash    1753 lakshmanan  255u   CHR  136,0      0t0       3 /dev/pts/0

Additional info

And at last use -r option for monitoring. Here is example of periodically (every 10 seconds) refresh of connection status for a concrete application started as php.
lsof -r 10 -c php -a -i :1521 
Next one uses the -t parameter which causes lsof return only a process id of a file using application. So following command allows you to kill all application that are using provided file.
kill -9 `lsof -t /tmp/obscure.lock`  

Comments

Popular posts from this blog

HAproxy logging

teamcity Automatic Agent Start under Linux

NFS mount add in fstab _netdev instead of default | firewall-cmd --list-all