Swiss Army Knife of Unix Debugging: lsof

http://www.catonmat.net/blog/unix-utilities-lsof/

by pkrumins • 17 years ago

130 27 17 years ago

jf• 17 years ago

Don't forget that you can use lsof to undelete files (provided that at least one process still has the file open): http://www.linux.com/archive/articles/58142

nailer4• 17 years ago

I think your post is actually more useful than the article.

mattiss• 17 years ago

Excellent! I think I know Unix pretty well, but it would be great if someone had a directory of common use scenarios that one could look through, rather than using Google and wading through horrible forum posts...

Estragon• 17 years ago

Not completely sure what you're asking for, here, but Command Line Fu might be in the ball park:

http://www.commandlinefu.com/commands/browse

PStamatiou• 17 years ago

doesn't seem like that's possible in OS X due to no /proc natively. I'm going to see if I can do it with MacFUSE & procfs..

ars• 17 years ago

You don't have to use lsof for that. Just find the pid of the process that has it open, then cd /proc/<pid>/fd and then ls -l

lsof doesn't really do anything for you if you know the pid already. (But it's great if you don't know the pid.)

Then, look through the list for your file, and copy the file descriptor just like in the article.

ajross• 17 years ago

This is true, but only in the kinda trivial sense that lsof is just a pretty front end to the /proc filesystem. The same is true of pmap and netstat, but they remain useful tools nonetheless.

yan• 17 years ago

If you feel that lsof is the swiss army knife of unix debugging, then you haven't done much serious unix debugging. Don't get me wrong, lsof is useful and even indispensable in some situations, but not exactly be-all-end-all.

DTrace fits that description much closer, even though its only available for OpenSolaris, OS X, I believe FreBSD has a port and Linux is getting one.

edit: also see: strace, ltrace, gdb, truss

clutchski• 17 years ago

Yeah, the headline is a poor analogy for an otherwise well-written and useful atricle.

nailer4• 17 years ago

You'd use SystemTap for kernel-level tracing and breakpoint debugging on Linux. Check the wiki for a bunch of useful pre-cut tap files.

Linux does indeed have a port of dtrace, but it's not legal due to Sun's license.

sp332• 17 years ago

OS X has a port of DTrace, so I doubt licensing is a big issue.

woadwarrior01• 17 years ago

Thats the first thing that came to my mind when I read it as well. DTrace (and strace to a lesser extent) are the first things which come to mind whenever you've got to debug anything or atleast get a clue about whats going on in a runaway process.

pkrumins4• 17 years ago

Two swiss knives for me then. One in the right pocket, the other in the left. ;)

Gonna write about strace in one of the next articles. And possibly also about dtrace in another article.

cliff• 17 years ago

Warning: lsof can cause a kernel panic in OSX. I haven't tested it since leopard, but if you loop lsof continuously you'll hit it. There's some kind of race condition.

lanstein• 17 years ago

I just sent him 'The Seasoned Schemer'. If anyone wants to send him 'The Reasoned Schemer', I'm sure he'd appreciate it, will be about $30 incl. int'l shipping. I know I really appreciate his posts. http://www.amazon.com/gp/registry/wishlist/QDKYO6OQUU4O?reve...

pkrumins4• 17 years ago

Thanks for "The Seasoned Schemer" book! You are absolutely right that I'd also appreciate "The Reasoned Schemer". :)

silentbicycle• 17 years ago

While you could send him The Reasoned Schemer (I already sold my copy), IMHO _The Art of Prolog_ is a far better book for learning the same material (logic programming, declarative programming, DSLs). Whatever you think about Prolog, it's as deep a book as SICP. Seriously wonderful. (O'Keefe's _The Craft of Prolog_ is a good follow-up.)

It's nice to have a hardbound copy of the newest edition, but the previous edition is available for comparatively cheap (US$6), and torrents of both seem to get around. FYI.

pkrumins4• 17 years ago

I had never heard about "The Art of Prolog". Gonna check it out!

pkrumins4• 17 years ago

Someone has bought me "The Reasoned Schemer"! :)

I will now have all three books, reasoned, seasoned and little schemer. :)

Huge thanks to the person who bought the reasoned schemer!

Merry Christmas!

spudlyo• 17 years ago

One of the reasons that advanced lsof usage isn't that common is that the Linux man page for it so dense, and a bunch of details you don't need to get started using it are in the first few pages. I've tried a number of times to get all the way through it and have never finished. Thankfully there are some examples at the end.

neilk• 17 years ago

As long as everybody is learning about lsof this week, you might also want to check out a similar utility, fuser, which lists which processes are using a particular file.

http://linuxcommand.org/man_pages/fuser1.html

It's really handy for some situations. For instance, if a process can't grab some port, you can use fuser to quickly determine which process grabbed it first.

sammcd• 17 years ago

I run into this a lot.

Port is in use 8003.

lsof -i :8003

Then I kill whatever process was on 8003. I do this a lot with my Django development if I didn't kill the server right the first time.

Swiss Army Knife of Unix Debugging: lsof

Related Stories