用户显示打开的文件
# lsof -u apache |more COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME httpd 4374 apache cwd DIR 252,1 4096 2 / httpd 4374 apache rtd DIR 252,1 4096 2 / httpd 4374 apache txt REG 252,1 354816 408099 /usr/sbin/httpd httpd 4374 apache mem REG 252,1 9488 408013 /usr/lib64/apr-util-1/apr_ldap-1.so httpd 4374 apache mem REG 252,1 27424 907 /lib64/libnss_dns-2.12.so httpd 4374 apache mem REG 252,1 65928 909 /lib64/libnss_files-2.12.so httpd 4374 apache mem REG 252,1 10416 408095 /usr/lib64/httpd/modules/mod_version.so httpd 4374 apache mem REG 252,1 27312 408054 /usr/lib64/httpd/modules/mod_cgi.so httpd 4374 apache mem REG 252,1 22992 408061 /usr/lib64/httpd/modules/mod_disk_cache.so [root@netkiller ~]# lsof -u www COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME httpd 2412 www DEL REG 0,4 12653 /dev/zero httpd 2412 www mem REG 8,2 90784 5636110 /lib64/libgcc_s-4.4.7-20120601.so.1
列出被打开的文件信息,排除root用户
[root@netkiller neo]# lsof -u ^root |more COMMAND PID TID USER FD TYPE DEVICE SIZE/OFF NODE NAME dbus-daem 448 dbus cwd DIR 253,1 4096 2 / dbus-daem 448 dbus rtd DIR 253,1 4096 2 / dbus-daem 448 dbus txt REG 253,1 441256 141406 /usr/bin/dbus-daemon;56822cb8 (deleted) dbus-daem 448 dbus DEL REG 253,1 146439 /usr/lib64/libnss_sss.so.2;56822cb8 dbus-daem 448 dbus DEL REG 253,1 151203 /usr/lib64/libnss_files-2.17.so;56822cb8 dbus-daem 448 dbus DEL REG 253,1 151199 /usr/lib64/libdl-2.17.so;56822cb8 dbus-daem 448 dbus DEL REG 253,1 133002 /usr/lib64/liblzma.so.5.0.99;56822ac0 dbus-daem 448 dbus DEL REG 253,1 133005 /usr/lib64/libpcre.so.1.2.0;56822ac0 dbus-daem 448 dbus DEL REG 253,1 132825 /usr/lib64/libc-2.17.so;56822cb8 dbus-daem 448 dbus DEL REG 253,1 151206 /usr/lib64/librt-2.17.so;56822cb8 dbus-daem 448 dbus DEL REG 253,1 132851 /usr/lib64/libpthread-2.17.so;56822cb8 dbus-daem 448 dbus DEL REG 253,1 133622 /usr/lib64/libcap-ng.so.0.0.0;56822cb8 dbus-daem 448 dbus mem REG 253,1 118792 133084 /usr/lib64/libaudit.so.1.0.0 dbus-daem 448 dbus mem REG 253,1 147120 133015 /usr/lib64/libselinux.so.1 dbus-daem 448 dbus mem REG 253,1 173288 133153 /usr/lib64/libexpat.so.1.6.0 dbus-daem 448 dbus DEL REG 253,1 132818 /usr/lib64/ld-2.17.so;56822cb8 dbus-daem 448 dbus 0r CHR 1,3 0t0 1028 /dev/null dbus-daem 448 dbus 1u unix 0xffff880426d4c740 0t0 14381 socket dbus-daem 448 dbus 2u unix 0xffff880426d4c740 0t0 14381 socket dbus-daem 448 dbus 3u unix 0xffff880428cd7800 0t0 14082 /var/run/dbus/system_bus_socket dbus-daem 448 dbus 4u a_inode 0,9 0 5639 [eventpoll] dbus-daem 448 dbus 5r a_inode 0,9 0 5639 inotify dbus-daem 448 dbus 6u sock 0,6 0t0 14179 protocol: NETLINK dbus-daem 448 dbus 7u unix 0xffff880428cd1e00 0t0 14180 socket dbus-daem 448 dbus 8u unix 0xffff880428cd5640 0t0 14181 socket dbus-daem 448 dbus 9u unix 0xffff880037101e00 0t0 5347943 /var/run/dbus/system_bus_socket dbus-daem 448 dbus 10u unix 0xffff8800292ae900 0t0 626418112 /var/run/dbus/system_bus_socket dbus-daem 448 dbus 11u unix 0xffff880426f3cec0 0t0 5345962 socket dbus-daem 448 dbus 12u unix 0xffff8801f8149e00 0t0 626420423 /var/run/dbus/system_bus_socket [root@netkiller ~]# lsof -u ^www COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME init 1 root txt REG 8,2 150352 2228260 /sbin/init init 1 root mem REG 8,2 65928 5636192 /lib64/libnss_files-2.12.so
组监控
[root@netkiller neo]# lsof -g 0 COMMAND PID PGID USER FD TYPE DEVICE SIZE/OFF NODE NAME kthreadd 2 0 root cwd DIR 202,1 4096 2 / kthreadd 2 0 root rtd DIR 202,1 4096 2 / kthreadd 2 0 root txt unknown /proc/2/exe ksoftirqd 3 0 root cwd DIR 202,1 4096 2 / ksoftirqd 3 0 root rtd DIR 202,1 4096 2 / ksoftirqd 3 0 root txt unknown /proc/3/exe kworker/0 5 0 root cwd DIR 202,1 4096 2 / kworker/0 5 0 root rtd DIR 202,1 4096 2 / kworker/0 5 0 root txt unknown /proc/5/exe migration 7 0 root cwd DIR 202,1 4096 2 / migration 7 0 root rtd DIR 202,1 4096 2 / migration 7 0 root txt unknown /proc/7/exe
原文出处：Netkiller 系列 手札
本文作者：陈景峯
转载请与作者联系，同时请务必标明文章原始出处和作者信息及本声明。
