Data lsof reports and where
lsof got the data.
COMMAND
This is the command name from the process or user structure.
Lsof prints only the first 9 characters. However, it
reports all characters in field output.
Lsof can be told to filter output by the command name via
its -c option.
PID
This is the Process IDentification number from the process
structure.
Lsof can be told to filter output by PID number via its -p
option.
PPID
This is the Parent Process IDentification number.
There is no filter option for PPID.
PGRP
This is the Process Group IDentification number.
Lsof can be told to filter output by PGRP ID via its -g
option.
USER
This is the identification of the user who owns the process.
Sometimes UID is taken from the p_uid member of the process
structure and sometimes from the pid struct to which the
proc structure points.
User identification is normally reported as a login name,
but can be reported as a User IDentification number via
lsof's -l option.
Lsof can be told to filter by use identification with its
-u option.
FD
Usually this is the file descriptor number, but can have
some special forms for open files that aren't connected
to file descriptors:
cwd for the current working directory
rtd for the root directory
txt for text (executable) files occupying
memory regions
mem for other memory-mapped files
Rxx for unrecognized region files whose
p_type is the two digit number xx.
The file descriptor is followed by two characters: 1) a
file access mode; and 2) a file lock status.
The file access mode is 'r' for read; 'w', write; and 'u'
for read and write. This information is taken from the
f_flag member of the file structure. Lsof can also be
directed to report the contents of f_flag.
The file lock status is determined by following the lock
list chain from the vnode. The first lock encountered in
the list determine what is reported: 'r' for a read lock
on part of the file; 'R' for a read lock on the entire
file; 'w' for a write lock on part of the file; and 'W"
for a write lock on the entire file.
TYPE
Usually this is the type reported in v_type -- e.g., VCHR,
VDIR, VREG, etc. However, lsof tries to limit the length
to four characters, so VFIFO becomes FIFO.
Lsof also uses the TYPE column to indicate socket files:
inet Internet domain
IPv4 where lsof supports IPv4 and IPv6
IPv6 where lsof supports IPv4 and IPv6
sock unknown domain
unix Unix domain
FILE-ADDR
This is the kernel file structure address lsof read from
the proc structure or file chunks. It is useful for
detecting (usually via scripts that post-process lsof field
output) file descriptors shared between processes -- e.g.,
inherited by a child from its parent -- especially when
excessive file descriptor use ("leaks") appear to be
occurring.
This item is only reported when selected with lsof's +ff
option, and when the open file is represented by a file
descriptor.
FCT
This is the f_count member of the file structure. It is
useful when chasing file descriptor "leaks" for determining
how many references a file descriptor has.
This item is only reported when selected with lsof's +fc
option, and when the open file is represented by a file
descriptor.
NODE-ID
This is the vnode address from the f_data member of the
file structure. It is useful for detecting (usually via
scripts that post-process lsof field output) files that
are shared between processes.
This item is only reported when selected with lsof's +fp
option, and when the open file is represented by a file
descriptor.
DEVICE
Two things may appear in the device column: 1) the major
and minor device number doublet of character and block
devices; or 2) a hexadecimal number that represents the
"device" of a pipe or socket -- e.g., the TCP/IP protocol
address also reported by netstat -A.
There are two reasons for reporting a hex number: 1) to
match with netstat -A output; and 2) to match a pipe or
socket whose only destination address is a similar hex
number.
SIZE/OFF
Lsof reports the file size or current position (offset from
f_offset of the file structure) in this column.
The default mode is to report offset for files that don't
have size in their node structures -- e.g., pipes, sockets,
character device files -- and size from the node structure
for everything else.
Several lsof options control what is reported: -o selects
offset (and suppresses size); -s selects size (and suppresses
offset); and -o[n] specifies how many offset digits are
to be reported in decimal (default 8) before the output
form switches to hexadecimal.
File size is very useful when a system administrator is
searching for unlinked files that are still consuming disk
space.
File offset is very useful to anyone who is watching for
activity on a character device file or socket. I use it
to measure progress of ftp transfers, for example.
NLINK
The file (e.g. inode) link count. This is usefile for
locating large unlinked files that are still being written
and are consuming needed disk space.
Lsof has a elementary filter for link count.
NODE
Usually the value in the NODE column is the associated node
structure's ID number -- e.g., the inode number.
However, some open files don't have a node structure. For
them lsof uses this column in a variety of ways.
NODE may contain the protocol (PF_*) value for TCP/IP
sockets.
NODE is blank for Unix sockets.
NODE may contain STR for streams.
NAME
The NAME column is the most complicated and overloaded
output field lsof produces.
Originally it was designed to receive the node name of
files attached to device nodes (VCHR) files or the mounted-on
directory and mounted-on device names for file systems In
many cases that information still appears in the NAME column.
However, along the way the NAME column has become used for
a wide variety of miscellaneous file information, including:
* Error messages about situations lsof has encountered --
e.g., it can't read a node structure via /dev/kmem.
* Socket file information:
o TCP/IP connection addresses (ports or service names, and
host names or IP numbers)
o TCP/IP connection information -- states (e.g., ESTABLISH,
or Unbound), received and send queue sizes, receive and
send queue window sizes
o FIFO and pipe information -- peer connection ID, data
in the pipes
o Unix socket information -- peer connection ID, file
system object (i.e., path name)
o The name of a file or file system specified as a search
search argument
o NFS mount points
o Stream module names, perhaps accompanied by a device,
clone device, or pseudo device name
o Raw socket address information
o Socket pair information
o Namefs (via fattach(3C)) information
o Full and partial path names, anchored at the containing
file system and extending through some or all kernel
name cache components
o Clone device names
o Pseudo device names
Of all these NAME column items, file system name, socket
connection parameters, character device node names, and
full path names are the most useful.
Vic Abell <abe@purdue.edu>
March 16, 1999