lsof是列出系统中被打开的文件
不加任何参数运行lsof
[root@client1 log]# lsof /var/log/cron
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
rsyslogd 1448 root 5w REG 253,0 3757 72172 cron
COMMAND:命令的名称
PID:进程号
USER:运行的用户
FD:文件描述符
TYPE:类型
DEVICE:设备类型
SIZE/OFF:文件大小
NODE:NODE号或者是协议
NAME:文件名
常用参数示例：
[root@client1 log]# lsof -c h
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
hald 1783 haldaemon cwd DIR 253,0 4096 2 /
hald 1783 haldaemon rtd DIR 253,0 4096 2 /
hald 1783 haldaemon txt REG 253,0 351136 59441 /usr/sbin/hald (deleted)
hald 1783 haldaemon mem REG 253,0 938956 72213 /var/cache/hald/fdi-cache
hald 1783 haldaemon mem REG 253,0 65928 134815 /lib64/libnss_files-2.12.so
hald 1783 haldaemon DEL REG 253,0 134827 /lib64/librt-2.12.so
hald 1783 haldaemon DEL REG 253,0 134799 /lib64/libc-2.12.so
-c h 参数显示COMMAND名称是以h开头的文件打开信息
[root@client1 log]# lsof -p 1827
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
hald-addo 1827 haldaemon cwd DIR 253,0 12288 131768 /usr/libexec
hald-addo 1827 haldaemon rtd DIR 253,0 4096 2 /
hald-addo 1827 haldaemon txt REG 253,0 15296 59379 /usr/libexec/hald-addon-acpi.#prelink#.4rrBmg (deleted)
hald-addo 1827 haldaemon mem REG 253,0 65928 134815 /lib64/libnss_files-2.12.so
hald-addo 1827 haldaemon DEL REG 253,0 134827 /lib64/librt-2.12.so
hald-addo 1827 haldaemon DEL REG 253,0 134799 /lib64/libc-2.12.so
hald-addo 1827 haldaemon DEL REG 253,0 134823 /lib64/libpthread-2.12.so.#prelink#.g7qiyh
hald-addo 1827 haldaemon DEL REG 253,0 135233 /lib64/libdbus-1.so.3.4.0.#prelink#.c3QEWj
hald-addo 1827 haldaemon DEL REG 253,0 136454 /usr/lib64/libhal.so.1.0.0.#prelink#.QHIBKM
hald-addo 1827 haldaemon DEL REG 253,0 135637 /lib64/libglib-2.0.so.0.2200.5.#prelink#.cCev1Q
-p 1827 显示PID为1827进程的文件打开信息
[root@client1 log]# lsof -u root|head
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
init 1 root cwd DIR 253,0 4096 2 /
init 1 root rtd DIR 253,0 4096 2 /
init 1 root txt REG 253,0 146240 4570 /sbin/init
init 1 root mem REG 253,0 65928 134815 /lib64/libnss_files-2.12.so
init 1 root DEL REG 253,0 134799 /lib64/libc-2.12.so
init 1 root DEL REG 253,0 131098 /lib64/libgcc_s-4.4.6-20110824.so.1.#prelink#.Unmo4w
init 1 root DEL REG 253,0 134827 /lib64/librt-2.12.so
init 1 root DEL REG 253,0 134823 /lib64/libpthread-2.12.so.#prelink#.g7qiyh
-u root 显示root用户打开的文件信息
[root@client1 log]# lsof -i :22
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
sshd 1890 root 3u IPv4 11133 0t0 TCP *:ssh (LISTEN)
sshd 1890 root 4u IPv6 11135 0t0 TCP *:ssh (LISTEN)
sshd 2037 root 3r IPv4 11909 0t0 TCP Client1.centos:ssh->192.168.2.128:4288 (ESTABLISHED)
-i :22 显示22号端口的打开信息
其他参数：
+d：按照目录搜寻，但是不打开子目录
+D：按照目录搜寻同时打开子目录
本文转自 waydee 51CTO博客，原文链接：http://blog.51cto.com/waydee/816852，如需转载请自行联系原作者
