General lsof Features

    Lsof does more than just report on open files, or look for
    Internet addresses for disovering the processes associated with
    them.

    It has two major additional features: 1) extensive filtering
    of open file information; and 2) reporting open file information
    in a way convenient for post-processing with filters (e.g.,
    AWK or Perl) scripts.

    Filtering

	Lsof has the following options for filtering open file
	information:

	-c	select a command or list of commands for reporting

	+|-d	search for open files in a specified directory
	+|-D

	-d	select by file descriptor

	-g	select by process group ID

	-i	select by Internet service names or port numbers,
		addresses or host names, and protocol

	+L	select by node link count

	-N	select NFS files

	-p	select by PID

	-u	select by login or UID

	-U	select Unix domain socket files

	<name>	search for an open file by name
		search for all open files on a named file system

    Output for Filtering

	Lsof produces output for post-filtering scripts.  It's
	called field output, because it's organized in field records,
	identified by key characters.

	The lsof distribution comes with sample scripts that use
	field output to:

	   Watch a particular file.

	   Watch for new TCP/IP connections.

	   Count processes and files.

	   Implement an identd or pidentd server.

	   Identify the Internet source of rlogin, telnet and ssh
	   connections.

	   Identifying processes that share file descriptors or
	   files.

	   Identify users and applications on X Window System work
	   stations.

    Vic Abell <abe@purdue.edu>
    March 17 1999