1 .显示所有打开的文件信息
分别为COMMAND、PID、USER、FD、TYPE、DEVICE、SIZE/OFF、NODE.NAMe等#lsof
commandpiduserfdtypedevicesize/off nodename
init1rootcwddir 253，040962 /
init1rootrtddir 253，040962 /
init1roottxtreg 253，0145180147164/sbin/init
init1rootmemreg 253，01889704190149/lib/libc-2.12.so
init1root0uchr 1，30t 03764/dev/null
init1root 1u chr 1，30t 03764/dev/null
init1root 2u chr 1，30t 03764/dev/null
init1root 3r FIFO 0，80t 08449 pipe
init1root4w FIFO 0，80t 08449 pipe
init1root5rdir 0，1001 inotify
init1root6rdir 0，1001 inotify
init1root7u UNIX0x c 15138800 t 08450插槽
FD C文件描述符：
cwd当前工作目录
rtd根目录
txt程序文本(代码/数据)。
mem内存映射文件---将磁盘文件映射到内存
r读访问
w写入访问
u读写访问
类型c文件类型描述符
DIR C目录
REG C普通文件
CHR C文字专业文件
BHR -块专用文件
先进先出堆栈
2 .列出特定用户打开的所有文件#lsof-utecmint
commandpiduserfdtypedevicesize/off nodename
shd 1838 tecmintcwddir 253，040962 /
shd 1838 tecmintrtddir 253，040962 /
shd 1838 tecminttxtreg 253，0532336188129/usr/sbin/sshd
shd 1838技术邮件253，019784190237/lib/lib dl-2.12.so
shd 1838 tecmintmemreg 253，0122436190247/lib/lib selinux.so.1
shd 1838 tecmintmemreg 253，0255968190256/lib/lib gssapi _ krb5.so.2.2
shd 1838 tecmintmemreg 253，0874580190255/lib/lib krb5.so.3.3
3 .使用- I选项列出指定端口的所有进程。 以下示例为22端口#lsof-iTCP:22
commandpiduserfdtypedevicesize/off nodename
shd1471路由
3u IPv4 12683 0t0 TCP *:ssh (LISTEN)sshd 1471 root 4u IPv6 12685 0t0 TCP *:ssh (LISTEN)
4. 仅列出IPv4或IPv6 O打开文件# lsof -i 4
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
rpcbind 1203 rpc 6u IPv4 11326 0t0 UDP *:sunrpc
rpcbind 1203 rpc 7u IPv4 11330 0t0 UDP *:954
rpcbind 1203 rpc 8u IPv4 11331 0t0 TCP *:sunrpc (LISTEN)
avahi-dae 1241 avahi 13u IPv4 11579 0t0 UDP *:mdns
avahi-dae 1241 avahi 14u IPv4 11580 0t0 UDP *:58600
# lsof -i 6
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
rpcbind 1203 rpc 9u IPv6 11333 0t0 UDP *:sunrpc
rpcbind 1203 rpc 10u IPv6 11335 0t0 UDP *:954
rpcbind 1203 rpc 11u IPv6 11336 0t0 TCP *:sunrpc (LISTEN)
rpc.statd 1277 rpcuser 10u IPv6 11858 0t0 UDP *:55800
rpc.statd 1277 rpcuser 11u IPv6 11862 0t0 TCP *:56428 (LISTEN)
cupsd 1346 root 6u IPv6 12112 0t0 TCP localhost:ipp (LISTEN)
5. 列出TCP端口在1-1024的所打开文件的所有运行进程# lsof -i TCP:1-1024
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
rpcbind 1203 rpc 11u IPv6 11336 0t0 TCP *:sunrpc (LISTEN)
cupsd 1346 root 7u IPv4 12113 0t0 TCP localhost:ipp (LISTEN)
sshd 1471 root 4u IPv6 12685 0t0 TCP *:ssh (LISTEN)
master 1551 root 13u IPv6 12898 0t0 TCP localhost:smtp (LISTEN)
sshd 1834 root 3r IPv4 15101 0t0 TCP 192.168.0.2:ssh->192.168.0.1:conclave-cpp (ESTABLISHED)
sshd 1838 tecmint 3u IPv4 15101 0t0 TCP 192.168.0.2:ssh->192.168.0.1:conclave-cpp (ESTABLISHED)
sshd 1871 root 3r IPv4 15842 0t0 TCP 192.168.0.2:ssh->192.168.0.1:groove (ESTABLISHED)
httpd 1918 root 5u IPv6 15991 0t0 TCP *:http (LISTEN)
httpd 1918 root 7u IPv6 15995 0t0 TCP *:https (LISTEN)
6. 排除用户用‘^’字符，例子为：排除root用户# lsof -i -u^root
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
rpcbind 1203 rpc 6u IPv4 11326 0t0 UDP *:sunrpc
rpcbind 1203 rpc 7u IPv4 11330 0t0 UDP *:954
rpcbind 1203 rpc 8u IPv4 11331 0t0 TCP *:sunrpc (LISTEN)
rpcbind 1203 rpc 9u IPv6 11333 0t0 UDP *:sunrpc
rpcbind 1203 rpc 10u IPv6 11335 0t0 UDP *:954
rpcbind 1203 rpc 11u IPv6 11336 0t0 TCP *:sunrpc (LISTEN)
avahi-dae 1241 avahi 13u IPv4 11579 0t0 UDP *:mdns
avahi-dae 1241 avahi 14u IPv4 11580 0t0 UDP *:58600
rpc.statd 1277 rpcuser 5r IPv4 11836 0t0 UDP *:soap-beep
rpc.statd 1277 rpcuser 8u IPv4 11850 0t0 UDP *:55146
rpc.statd 1277 rpcuser 9u IPv4 11854 0t0 TCP *:32981 (LISTEN)
rpc.statd 1277 rpcuser 10u IPv6 11858 0t0 UDP *:55800
rpc.statd 1277 rpcuser 11u IPv6 11862 0t0 TCP *:56428 (LISTEN)
7. 找出谁查看了文件和目录：显示用户tecmint使用情况的命令# lsof -i -u tecmint
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
bash 1839 tecmint cwd DIR 253,0 12288 15 /etc
ping 2525 tecmint cwd DIR 253,0 12288 15 /etc
8. 列出所有网络连接：
选项‘-i’显示所有监听(LISTENING)和建立(ESTABLISHED)等的网络链接。# lsof -i
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
rpcbind 1203 rpc 6u IPv4 11326 0t0 UDP *:sunrpc
rpcbind 1203 rpc 7u IPv4 11330 0t0 UDP *:954
rpcbind 1203 rpc 11u IPv6 11336 0t0 TCP *:sunrpc (LISTEN)
avahi-dae 1241 avahi 13u IPv4 11579 0t0 UDP *:mdns
avahi-dae 1241 avahi 14u IPv4 11580 0t0 UDP *:58600
rpc.statd 1277 rpcuser 11u IPv6 11862 0t0 TCP *:56428 (LISTEN)
cupsd 1346 root 6u IPv6 12112 0t0 TCP localhost:ipp (LISTEN)
cupsd 1346 root 7u IPv4 12113 0t0 TCP localhost:ipp (LISTEN)
sshd 1471 root 3u IPv4 12683 0t0 TCP *:ssh (LISTEN)
master 1551 root 12u IPv4 12896 0t0 TCP localhost:smtp (LISTEN)
master 1551 root 13u IPv6 12898 0t0 TCP localhost:smtp (LISTEN)
sshd 1834 root 3r IPv4 15101 0t0 TCP 192.168.0.2:ssh->192.168.0.1:conclave-cpp (ESTABLISHED)
httpd 1918 root 5u IPv6 15991 0t0 TCP *:http (LISTEN)
httpd 1918 root 7u IPv6 15995 0t0 TCP *:https (LISTEN)
clock-app 2362 narad 21u IPv4 22591 0t0 TCP 192.168.0.2:45284->www.gov.com:http (CLOSE_WAIT)
chrome 2377 narad 61u IPv4 25862 0t0 TCP 192.168.0.2:33358->maa03s04-in-f3.1e100.net:http (ESTABLISHED)
chrome 2377 narad 80u IPv4 25866 0t0 TCP 192.168.0.2:36405->bom03s01-in-f15.1e100.net:http (ESTABLISHED)
9. 用进程号(PID)搜索使用情况：显示进程1使用情况。# lsof -p 1
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
init 1 root cwd DIR 253,0 4096 2 /
init 1 root rtd DIR 253,0 4096 2 /
init 1 root txt REG 253,0 145180 147164 /sbin/init
init 1 root mem REG 253,0 1889704 190149 /lib/libc-2.12.so
init 1 root mem REG 253,0 142472 189970 /lib/ld-2.12.so
10. 杀死特定用户的所有活动进程# kill -9 `lsof -t -u tecmint`
本文出自 “瑞航启程--下一代企业应用” 博客，谢绝转载！