Which process open file linux

Linux / UNIX List Open Files for Process

H ow do I list all open files for a Linux or UNIX process using command line options? How can I show open files per process under Linux?

Both Linux and Unix-like operating systems come with various utilities to find out open files associated with the process.

Tutorial details
Difficulty level	Easy
Root privileges	Yes
Requirements	None
Est. reading time	3 minutes

UNIX List Open Files For Process

First use the ps command command to get PID of process, enter:
$ ps -aef | grep $ ps -aef | grep httpd
Next pass this PID to pfiles command under Solaris Unix:
$ pfiles
$ pfiles 3533
See pfiles command documentation> for more information or type the following man command:
% man pfiles

FreeBSD list open files per process

On FreeBSD use the fstat command along with the ps command:
# ps aux | grep -i openvpn # filter outputs using the grep command #
# fstat -p
# fstat -p 1219
We can count open files count for openvpn process as follows using the wc command:
# fstat -p 1219 | grep -v ^USER | wc -l
The -p option passed to the fstat to report all files open by the specified process.

FreeBSD pstat command in action

Linux List Open Files For Process

First you need to find out PID of process. Simply use any one of the following command to obtain process id:
# ps aux | grep OR
$ ps -C -o pid=
For example, find out PID of firefox web-browser, enter:
$ ps -C firefox -o pid=
Output:

To list opne files for firefox process, enter:
$ ls -l /proc/7857/fd
Sample output:

• No ads and tracking
• In-depth guides for developers and sysadmins at Opensourceflare✨
• Join my Patreon to support independent content creators and start reading latest guides:
  • How to set up Redis sentinel cluster on Ubuntu or Debian Linux
  • How To Set Up SSH Keys With YubiKey as two-factor authentication (U2F/FIDO2)
  • How to set up Mariadb Galera cluster on Ubuntu or Debian Linux
  • A podman tutorial for beginners – part I (run Linux containers without Docker and in daemonless mode)
  • How to protect Linux against rogue USB devices using USBGuard

Join Patreon ➔

For privileged process use the sudo command and to count open files use the wc command on Linux as follows:
# Get process pid
sudo ps -C Xorg -o pid
sudo ls -l /proc/$/fd
# Say pid is 9497 for Xorg, then
sudo ls -l /proc/9497/fd | wc -l
We can use bash for loop as follows too:

Listing Open Files on Linux

Using lsof to display the processes using the most file handles

The lsof command list open files under all Linux distributions or UNIX-like operating system. Type the following command to list open file for process ID 351:
$ lsof -p 351
In this example display and count all open files for top 10 processes on Linux operating systems or server:
# lsof | awk ‘‘ | sort | uniq -c | sort -r | head
## force numeric sort by passing the ‘-n’ option to the sort ##
# lsof | awk ‘‘ | sort | uniq -c | sort -r -n | head

• lsof – Run the lsof to display all open files and send output to the awk
• awk ‘‘ – Display first field i.e. process name only
• uniq -c – Omit duplicate lines while prefix lines by the number of occurrences
• sort -r – Reverse sort
• head – Display top 10 process along with open files count

Conclusion

Now you know how to find open files per process on Linux, FreeBSD, and Unix-like systems using various command-line options. See how to increase the system-wide/user-wide number of available (open) file handles on Linux for more information.

🐧 Get the latest tutorials on Linux, Open Source & DevOps via

Источник

How find out which process is using a file in Linux?

I tried to remove a file in Linux using rm -rf file_name , but got the error:

How can I find out which process is using this file?

4 Answers 4

You can use the fuser command, like:

You will receive a list of processes using the file.

You can use different flags with it, in order to receive a more detailed output.

You can find more info in the fuser’s Wikipedia article, or in the man pages.

@jim’s answer is correct — fuser is what you want.

Additionally (or alternately), you can use lsof to get more information including the username, in case you need permission (without having to run an additional command) to kill the process. (THough of course, if killing the process is what you want, fuser can do that with its -k option. You can have fuser use other signals with the -s option — check the man page for details.)

For example, with a tail -F /etc/passwd running in one window:

Note that you can also use lsof to find out what processes are using particular sockets. An excellent tool to have in your arsenal.

For users without fuser :

Although we can use lsof, there is another way i.e., we can query the /proc filesystem itself which lists all open files by all process.

Sample output below:

l-wx——. 1 root root 64 Aug 15 02:56 /proc/5026/fd/4 -> /var/log/filename.log

From the output, one can use the process id in utility like ps to find program name

Источник

How to Find Out Who is Using a File in Linux

In this article, we will explain how to find out who is using a particular file in Linux. This will help you know the system user or process that is using an open file.

We can use the lsof command to know if someone is using a file, and if they are, who. It reads kernel memory in its search for open files and helps you list all open files. In this case, an open file may be a regular file, a directory, a block special file, a character special file, a stream, a network file and many others – because in Linux everything is a file.

Lsof is used on a file system to identify who is using any files on that file system. You can run lsof command on Linux filesystem and the output identifies the owner and process information for processes using the file as shown in the following output.

To list user specific opened files, run the following command replace tecmint with the actual user name.

Another important use of lsof is to find out the process listening on a specific port. For example identify the process listening on port 80 using the following command.

Note: Since lsof reads kernel memory in its search for open files, rapid changes in kernel memory may result into unpredictable outputs. This is one of the major downsides of using lsof command.

For more information, look at the lsof man page:

That’s all! In this article, we have explained how to know who is using a particular file in Linux. We have shown how to identify the owner and process information for processes using an open file. Use the feedback form below to reach us for any questions or comments.

If You Appreciate What We Do Here On TecMint, You Should Consider:

TecMint is the fastest growing and most trusted community site for any kind of Linux Articles, Guides and Books on the web. Millions of people visit TecMint! to search or browse the thousands of published articles available FREELY to all.

If you like what you are reading, please consider buying us a coffee ( or 2 ) as a token of appreciation.

We are thankful for your never ending support.

Источник

How can I determine what process has a file open in Linux?

I’d like to determine what process has ownership of a lock-file. The lock-files are simply a file with a specific name that has been created.

So, how can I determine what process has a particular file open in Linux? Preferably a one-liner type or a particular Linux tool solution would be optimal.

5 Answers 5

You can also use fuser for this:

On most Linux systems lsof NAME does the job:

Having a file open is not a lock because, if each process has to check whether the file is open first and not proceed if it is or create/open it if it isn’t, then two processes could quite well check simultaneously, both find that it isn’t open, then both create or open it.

To use a file as a lock, the check-and-lock operation has to be a single uninterruptable operation. You can achieve this in a Unix filesystem by creating a file with read-only mode and removing it to unlock. If the file exists (and is read only) the file creation will fail, so you get check-and-lock in a single atomic operation.

If your locking process is a shell script that will be running as a daemon, you can get this effect by using umask , a per-process setting that sets the permissions that new files are created with:

This also writes the owning process’ PID into the file, which solves your other problem: cat /var/lock/foo As regards the specific question «Which processes have this file open?», this can be useful when you want to unmount a filesystem but can’t because some process has a file open in it. If you don’t have those commands available, you can ask /proc as root:

ls -l /proc/*/cwd | grep ‘/var/lock/foo$’

or, as a mortal user:

ls -l /proc/*/cwd 2>/dev/null | grep ‘/var/lock/foo$’

Источник

How do I find the file handles that my process has opened in Linux?

When we perform a fork in Unix, open file handles are inherited, and if we don’t need to use them we should close them. However, when we use libraries, file handles may be opened for which we do not have access to the handle. How do we check for these open file handles?

9 Answers 9

In Linux you can check /proc/

/fd directory — for every open fd there will be a file, named as handle. I’m almost sure this way is non-portable.

Alternatively you can use lsof — available for Linux, AIX, FreeBSD and NetBSD, according to man lsof .

You can do from a shell:

lsof -P -n -p _PID_

Where PID is your process pid.

If the libraries are opening files you don’t know about, how do you know they don’t need them after a fork? Unexported handles are an internal library detail, if the library wants them closed it will register an atfork() handler to close them. Walking around behind some piece of code closing its file handles behind its back will lead to subtle hard to debug problems since the library will error unexpectedly when it attempts to work with a handle it knows it opened correctly, but did not close.

As mentioned on @Louis Gerbarg’s answer, the libraries are probably expecting the file handles to be kept open on fork() (which is supposed to be, after all, an almost identical copy of the parent process).

The problem most people have is on the exec() which often follows the fork() . Here, the correct solution is for the library which created the handles to mark them as close-on-exec ( FD_CLOEXEC ).

On libraries used by multithread programs, there is a race condition between a library creating a file handle and setting FD_CLOEXEC on it (another thread can fork() between both operations). To fix that problem, O_CLOEXEC was introduced in the Linux kernel.

To start with, you don’t really need to care a whole lot about the open file descriptors you don’t know about. If you know you’re not going to write to them again, closing them is a good idea and doesn’t hurt — you just did a fork() after all, the fds are open twice. But likewise, if you leave them open , they won’t bother you either — after all, you don’t know about them, you presumably won’t be randomly writing to them.

As for what your third-party libraries will do, it’s a bit of a toss-up either way. Some probably don’t expect to run into a situation with a fork(), and might end up accidentally writing to the same fd from two processes without any synchronization. Others probably don’t expect to have you closing their fds on them. You’ll have to check. This is why it’s a bad idea to randomly open a file descriptor in a library and not give it to the caller to manage.

All that said, in the spirit of answering the original question, there isn’t a particularly good way. You can call dup() or dup2() on a file descriptor; if it’s closed, the call will fail with EBADF . So you can say:

but at that point you’re just as well off saying close(oldfd) in the first place and ignoring any EBADFs.

Assuming you still want to take the nuclear option of closing everything, you then need to find the maximum number of open file descriptors possible. Assuming 1 to 65,535 is not a good idea. First of all, fds start at 0, of course, but also there’s no particular upper limit defined. To be portable, POSIX’s sysconf(_SC_OPEN_MAX) should tell you, on any sane POSIX system, though strictly speaking it’s optional. If you’re feeling paranoid, check the return value for -1, though at that point you mostly have to fall back on a hardcoded value anyway (1024 should be fine unless you’re doing something extremely weird). Or if you’re fine with being Linux-specific, you can dig around in /proc.

Don’t forget to not close fds 0, 1, and 2 — that can really confuse things.

Источник