Contents
Why do I get a warning when I run lsof?
lsof: WARNING: can’t stat () fuse.gvfsd-fuse file system /run/user/1000/gvfs Output information may be incomplete. lsof tries to process all mounted filesystems. This warning message is raised because lsof has encountered a GNOME Virtual file system (GVFS). This is a special case of a filesystem in user space (FUSE).
What does device mean in Linux lsof command?
Device: Contains either the device numbers, separated by commas, for a character special, block special, regular, directory or NFS file, or a kernel reference address that identifies the file. It might also show the base address or device name of a Linux AX.25 socket device. Size/Off: Shows the size of the file or the file offset in bytes.
What are the entries in the lsof command?
There are over 70 entries that might appear in the TYPE column. Some common entries you will see are: REG: Regular filesystem file. DIR: Directory. FIFO: First In First Out. CHR: Character special file. BLK: Block special file. INET: Internet socket.
How do I get lsof to report on files opened?
We can make lsof report on the files that were opened by internet or network connections on a specific port. To do this, we use the : character followed by the port number. Here we’re asking lsof to list the files that have been opened by network or internet connections using port 22. lsof -i :22
What does the output of lsof look like?
The output from lsof is very wide. The leftmost columns are: The rightmost columns are: All columns do not apply to every type of open file. It is normal for some of them to be blank. Command : The name of the command associated with the process that opened the file. PID : Process Identification number of the process that opened the file.
How does lsof show list of opened files?
lsof provides a list of the files that have been opened by either of the processes provided on the command line. To limit the display to the files that have been opened by a specific user, use the -u (user) option. In this example, we’ll look at the files that have been opened by processes that are owned or launched on behalf of Mary.
Why is there no PWD entry in lsof?
That’s what the lsof output is indicating. There’s a process running owned by UID 105, but when it tried to lookup the username, there’s no entry for that UID in /etc/passwd. Most likely the process was started before the user was deleted, and has been running ever since.