How to interpret lsof

[TSch]

Hi everybody,

I'm not quite sure how to interpret the output of the lsof command...

Can anyone tell me what all the columns stand for ?
(Especially FD, which contains something like 4u, 8u, etc.)

Thanks in advance

Regards
Thomas

 

[aixqueen]

If you do a man on lsof (provided you installed it right and copied the man pages with it)

OUTPUT
This section describes the information lsof lists for each
open file. See the OUTPUT FOR OTHER PROGRAMS section for
additional information on output that can be processed by
another program.

COMMAND contains the first nine characters of the name of
the UNIX command associated with the process.

All command name characters saved by the kernel
All command name characters saved by the kernel
sixteen characters) are displayed in field output
when the command name descriptor (`c') is
specified. See the OUTPUT FOR OTHER PROGRAMS
section for information on selecting field output
and its command name descriptor.

PID is the Process IDentification number of the
process.

PGRP is the process group IDentification number
associated with the process. It is only
displayed when the -g option has been specified.

USER is the user ID number or login name of the user
to whom the process belongs. (See the -l option
description.)

FD is the File Descriptor number of the file or:
cwd current working directory;
Lnn library references;
ltx shared library text (code and data);
Mxx hex memory-mapped type number xx.
m86 DOS Merge mapped file;
mem memory-mapped file;
pd parent directory;
rtd root directory;
txt program text (code and data);
v86 VP/ix mapped file;

FD is followed by one of these characters,
describing the mode under which the file is open:

r for read access;
w for write access;
u for read and write access;
space if unknown (e.g., cwd or txt).

The mode character is followed by one of these
characters, describing the type of lock applied
to the file:
N for a Solaris NFS lock of unknown type;
r for read lock on part of the file;
R for a read lock on the entire file;
w for a write lock on part of the file;
W for a write lock on the entire file;
u for a read and write lock of any length;
U for a lock of unknown type;
x for an SCO OpenServer Xenix lock on part
of the file;
X for an SCO OpenServer Xenix lock on the
entire file;
space if there is no lock.

See the LOCKS section for more information on the
lock information character.

TYPE is the type of the node associated with the file
- e.g., GDIR, GREG, VDIR, VREG, etc.
or ``ax25'' for a Linux AX.25 socket;
or ``dnet'' for a DECnet socket;
or ``inet'' for an Internet domain socket;
or ``lla'' for a HP-UX link level access file;
or ``rte'' for an AF_ROUTE socket;
or ``sock'' for a socket of unknown domain;
or ``unix'' for a UNIX domain socket;
or ``x.25'' for an HP-UX x.25 socket;
or ``BLK'' for a block special file;
or ``CHR'' for a character special file;
or ``DIR'' for a directory;
or ``FIFO'' for a FIFO special file;
or ``LINK'' for a symbolic link file;
or ``MPB'' for a multiplexed block file;
or ``MPC'' for a multiplexed character file;
or ``PAS'' for a /proc/as file;
or ``PAXV'' for a /proc/auxv file;
or ``PCRE'' for a /proc/cred file;
or ``PCTL'' for a /proc control file;
or ``PCUR'' for the current /proc process;
or ``PCWD'' for a /proc current working directory;
or ``PFD'' for a /proc file descriptor;
or ``PFDR'' for a /proc file descriptor directory;
or ``PFIL'' for an executable /proc file;
or ``PFPR'' for a /proc FP register set;
or ``PGD'' for a /proc/pagedata file;
or ``PGRP'' for a /proc group notifier file;
or ``PIPE'' for pipes;
or ``PLC'' for a /proc/lwpctl file
or ``PLDT'' for a /proc/ldt file;
or ``PLPI'' for a /proc/lpsinfo file;
or ``PLST'' for a /proc/lstatus file;
or ``PLU'' for a /proc/lusage file;
or ``PLWG'' for a /proc/gwindows file;
or ``PLWI'' for a /proc/lwpsinfo file;
or ``PLWS'' for a /proc/lwpstatus file;
or ``PLWU'' for a /proc/lwpusage file;
or ``PLWX'' for a /proc/xregs file'
or ``PMAP'' for a /proc/map file;
or ``PMEM'' for a /proc memory image file;
or ``PMEM'' for a /proc memory image file;
or ``PNTF'' for a /proc process notifier file;
or ``POBJ'' for a /proc/object file;
or ``PODR'' for a /proc/object directory;
or ``POLP'' for an old format /proc light weight
process file;
or ``POPF'' for an old format /proc PID file;
or ``POPG'' for an old format /proc page data file;
or ``PORT'' for an Ultrix SYSV named pipe;
or ``PREG'' for a /proc register file;
or ``PRMP'' for a /proc/rmap file;
or ``PRTD'' for a /proc root directory;
or ``PSGA'' for a /proc/sigact file;
or ``PSIN'' for a /proc/psinfo file;
or ``PSTA'' for a /proc status file;
or ``PUSG'' for a /proc/usage file;
or ``PW'' for a /proc/watch file;
or ``REG'' for a regular file;
or ``SMT'' for a shared memory transport file;
or ``UNNM'' for an unnamed type file.

DEVICE contains the major and minor device numbers for a
character special, block special, regular, directory or NFS file (an
HP-UX minor device directory or NFS file (an HP-UX minor device
UNIX minor device number larger than 99,999);
or the protocol control block address of a DECnet
(Ultrix 4.2), Internet, UNIX, or x.25 (HP-UX)
network file - the address that appears in the -A
output from some netstat(1) programs;

or ``memory'' for a memory file system node under
Digital UNIX;

or the address of the private data area of a
Solaris socket stream;

or a kernel reference address that identifies the
file (The kernel reference address may be used
for FIFO's, for example.);

or the base address of a Linux AX.25 socket
device.

Usually only the lower thirty two bits of Digital
UNIX kernel addresses are displayed.