【IT168 服务器学院】LSOF（list open files）是针对Unix的诊断和分析工具，该工具可以通过进程与打开的文件系统进行联系，显示出由系统里正在运行的进程所打开的文件，也能显示出每一个进程的通讯socket。可是在Tru 64上并没有包含在系统里发行，出于对这个系统的特殊感情，我将这个免费的GUN软件的最新版本的安装和使用技巧在这里给大家做一个详细介绍，希望能给喜欢的网友提供帮助。我机器操作系统的版本为：tru 64 4.0F 。
一、LSOF 4.74安装过程
最新源码地址
ftp://sunsite.tus.ac.jp/pub/sun-info/Solaris/SOURCES/lsof-4.74.tar.gz
解压缩过程
# gunzip lsof-4.74.tar.gz
# tar -xvf lsof-4.74.tar
# cd lsof_4.74
# sum lsof_4.74_src.tar
27747 4044 lsof_4.74_src.tar(显示文件的校验和以及块数)
#tar –xvf lsof_4.74_src.tar
配置、编译及安装过程
# ./Configure du
Please enter the name of the subdirectory in /usr/sys that contains theconfiguration files for this host. Usually its name would be XP3, butthat subdirectory doesn''t seem to exist. The lsof compilation needs headerfiles specific to this machine''s configuration found in that directory.If you can''t specify the appropriate configuration subdirectory, quit this Configure step now and generate a proper configuration subdirectory with the kernel generation process.
/usr/sys contains:
BINARY/arch/ conf/ io/net/ streams/ vfs/
XP003/ bin/ data/ kern/ nfs/ streamsm/
XP005/ bsd/ include/ kits/ procfs/ufs/
Configuration subdirectory name? 你的主机名（大写）
Using header files in /usr/sys/XP003
Determining the ADVFS version -- this will take a while.The ADVFS version is 4.This configuration step (the Inventory script) takes inventory of the lsof distribution. The script runs for a minute or two while it checks that all the subdirectories, information files, scripts,header files and source files that should be present really are.
。。。。。。
It''s not absolutely necessary that you take inventory, but it''s a good idea to do it right after the lsof distribution has been unpacked. Once the inventory has been taken, this script creates the file ./.ck00MAN as a signal that the inventory step has been done.
You can call the Inventory script directly at any time to take inventory. You can inhibit the inventory step permanently by creating the file ./.neverInv, and you can tell the Configure script
to skip the inventory and customization steps with the -n option.
Do you want to take inventory (y|n) [y]? Y
Conducting an inventory of the lsof distribution; this will take a while.
。。。。。。
./Customize script.
Do you want to customize (y|n) [y]? Y
Customizing ...
=====================================================================
When HASSECURITY is enabled, only the root user may use lsof to examine all open files; other users may examine only the files belonging to the real user ID of their lsof process. If HASNOSOCKSECURITY is also defined, anyone may list anyone else''s open socket files, provided their listing is selected with the "-i" option.
When HASSECURITY is disabled, anyone may use lsof to examine all open files.
HASSECURITY is disabled.
Enable HASSECURITY (y|n) [n]? Y
HASSECURITY will be enabled.
====================================================================
When HASSECURITY is enabled, you may also define HASNOSOCKSECURITY.When both are defined, no one but root may list all of anyone else''s open files -- only their own open files -- but anyone may list anyone else''s open socket files.
This option is useful with ntop (http://www.ntop.org).
HASNOSOCKSECURITY is disabled.
Enable HASNOSOCKSECURITY (y|n) [n]? Y
HASNOSOCKSECURITY will be enabled.
=====================================================================
When WARNINGSTATE is enabled, lsof will will issue whatever warning messages it finds necessary. When WARNINGSTATE is disabled, lsof will issue no warning messages. For individual uses of lsof, -w disables warning state and +w enables it.
WARNINGSTATE is enabled.
Disable WARNINGSTATE? (y|n) [n]? Y
WARNINGSTATE will be disabled.
=====================================================================
When WARNDEVACCESS is enabled, lsof will issue warning messages when it can''t access nodes in /dev (or /devices), subject to the default or explicit (-w) WARNINGSTATE.
When WARNDEVACCESS is disabled, lsof will silently skip nodes in /dev (or /devices) that it can''t access.
WARNDEVACCESS is enabled.
Disable WARNDEVACCESS (y|n) [n]? Y
WARNDEVACCESS will be disabled.
=====================================================================
When HASDCACHE is enabled, lsof will write a device cache file that contains information about the nodes in /dev (or /devices). The options HASENVDC, HASPERSDC, HASPERSDCPATH, and HASSYSDC define the device cache file path.When HASDCACHE is disabled, lsof won''t write a device cache file.Consult the 00DCACHE and 00FAQ files of the lsof distribution for more information.
HASDCACHE is enabled.
Disable HASDCACHE (y|n) [n]? Y
HASDCACHE will be disabled.
=====================================================================
When HASKERNIDCK is enabled, lsof compares the identity of the kernel where it was built to the identity of the kernel where it is running. This check can detect an lsof executable inappropriate for the system on which it is being run.
The kernel identity check can take considerable time on some UNIX dialects -- e.g., AIX -- so there may be occasions when it is desirable to disable it, in spite of the increased risk of using
an inappropriate lsof executable.
HASKERNIDCK is enabled.
Disable HASKERNIDCK (y|n) [n]? Y
HASKERNIDCK will be disabled.
=====================================================================
A new machine.h file has been created in "new_machine.h".
Do you want to rename machine.h to machine.h.old and replace it with
new_machine.h (y|n) [y]? Y
You may now run the make command -- e.g.,
$ make
#make；编译后，接着将生成的几个主要文件拷贝到相应的系统目录下。
#cp lsof /sbin
#gzip lsof.man
#mv lsof.man.gz lsof.1.gz
#cp lsof.1.gz /usr/man/man1
# lsof -v
lsof version information:
revision: 4.74
latest revision: ftp://lsof.itap.purdue.edu/pub/tools/unix/lsof/
latest FAQ: ftp://lsof.itap.purdue.edu/pub/tools/unix/lsof/FAQ
latest man page: ftp://lsof.itap.purdue.edu/pub/tools/unix/lsof/lsof_man
Only root can list all files, but anyone can list socket files.
/dev warnings are disabled.
Kernel ID check is disabled.
哈哈，安装成功！注意：在配置源文件的过程中，选项很多，系统管理人员可根据自己的需要来填，上面的是我自己的选择，不见得为非常好的方案。
二、LSOF使用技巧
lsof的功能很多，特別提醒大家， -c，-g，-p，-u，这四个参数最有用。更详细的资料请参看：man lsof。以下给大家介绍一下我在工作中，经常使用的技巧：
1、查看文件系统阻塞
根据工作需要，系统管理员想卸载一个文件系统并执行umount /mountpoint，但程序报告常常显示：umount: /mountpoint: device is busy；这是因为该文件系统上有正在打开的文件而不允许你这么做。这时，我们需要知道哪些文件、程序及用户仍在使用该系统，以便通知用户退出该系统，可以使用lsof识别正在打开一个特定文件系统的进程，执行如下命令：
/usr/sbin/lsof /mountpoint
在这里，mountpoint就是安装位置。例如：
# /usr/sbin /lsof /home
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
bash12134 meng cwdDIR8,5 4096 32705 /home/meng
telnet 12176 meng cwdDIR8,5 4096 32705 /home/meng
bash19809 meng cwdDIR8,5 4096 32705 /home/meng
bash20276 meng cwdDIR8,5 4096 32705 /home/meng
su 20315 root cwdDIR8,5 4096 32705 /home/meng
bash20316 root cwdDIR8,5 4096 32705 /home/meng
csh 20374 root cwdDIR8,5 4096 32705 /home/meng
lsof 20396 root cwdDIR8,5 4096 32705 /home/meng
lsof 20397 root cwdDIR8,5 4096 32705 /home/meng
显然，所有使用这些被打开的文件的进程都需要在文件系统能够被卸载前被终止。管理员以root身份，kill掉占用这个文件系统的进程，解除文件系统阻塞。
2、搜索打开的网络连接
如果想搜索IP地址为10.645.64.23的远程连接主机的所有网络连接,可以执行如下命令:
/usr/sbin/lsof –i@10.65.64.23可以打开系统中该远程知己所有打开的套接字。
# lsof -i@10.65.64.23
COMMAND PID USER FD TYPE DEVICE SIZE/OFF INODE NAME
telnetd 6605 root0u inet 0x14813f00 0t0 TCP xpp3:telnet->linuxone:33143 (ESTABLISHED)
telnetd 6605 root1u inet 0x14813f00 0t0 TCP xpp3:telnet->linuxone:33143 (ESTABLISHED)
telnetd 6605 root2u inet 0x14813f00 0t0 TCP xpp3:telnet->linuxone:33143 (ESTABLISHED)
3、寻找本地断开的打开文件
用户经常遇到这种情况，当一个进程正在向一个文件写数据时，该文件的目录可能被移动。这就产生了一个非常大的问题。例如，用户可能发现正在向/data写数据，但是却看不到文件增大，LSOF这个工具可以找到这样的错误，例如：
/usr/sbin/lsof +L1，通常可以看到下面的信息：
# lsof +L1
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NLINKNODE NAME
svrMgt_mi458 root 4r VREG 8,00 0 3418 / (/dev/rz0a)
yes 677 root 1w VREG 8,0 186523648 0 92888 / (/de v/rz0a)
# lsof +L1
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NLINK NODE NAME
svrMgt_mi458 root 4r VREG 8,0 0 0 3418 / (/dev/rz0a)
yes 677 root1w VREG 8,0 2735882240 92888 / (/dev/rz0a)
我们可以用kill -9 PID命令来结束PID显示的命令排除错误，释放空间。
我们还可以用-a选项来限制lsof报告单文件系统中的链接数量。例如，为了限制到/data部分的输出，可以输入：/usr/sbin/lsof –a +L1 /data
4、搜索被程序打开的所有文件及打开的文件相关联进程
如果想知道执行PID号为637的sendmail命令打开了哪些文件的话，可以执行lsof -p 637命令。输出的结果如下：
# lsof -p 637
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
sendmail 637 root cwd VDIR8,6 512 470400 /usr/var/spool/mqueue
sendmail 637 root txt VREG8,6 466944 9650 /usr (/dev/rz0g)
sendmail 637 root txt VREG8,0 139264 16016 /sbin/loader
sendmail 637 root txt VREG8,0 1663104 38402 /shlib/libc.so
sendmail 637 root0r VCHR2,2 0t0 9607 /dev/null
sendmail 637 root1w VCHR2,2 0t0 9607 /dev/null
sendmail 637 root2w VCHR2,2 0t0 9607 /dev/null
sendmail 637 root3u unix 0x0c2fc280 0t0->0x1ead2b40
sendmail 637 root4u inet 0x0c34c200 0t0TCP *:smtp (LISTEN)
上述输出信息显示了该程序当前打开的所有文件、设备、库及套接字等。
执行下面的命令可以发现哪些进程正在使用某个特定的文件，如下所示，可以看出，只有系统记录后台进程syslogd打开messages这个文件。
# lsof /var/adm/messages
COMMAND PID USER FD TYPE DEVICE SIZE/OFF INODE NAME
syslogd 147 root 16w VREG8,6 2653365 22501 /usr/var/adm/messages
5、其它使用命令(更详细的资料请man lsof，这部分参看了一些资料给大家总结一下)
若沒有加上任何的参数，lsof 会列出所有被程序打开的文件。
参数可以相互结合，ex: -a -b -c 等同于 -abc
-? -h 这两个参数意思相同，显示出 lsof 的使用说明。
-a 参数被视为 AND （注意:-a参数一但加上 ，会影响全部的参数。）
-c c 显示出以字母 c开头进程现在打开的文件
例:显示以init进程现在打开的文件
# lsof -c init
COMMAND PID USER FD TYPE DEVICE SIZE/OFF INODE NAME
init 1 root cwd VDIR 4095,365376 8192 2 /
init 1 root txt VREG 4095,365376 286720 463 /sbin/init
+d s 依照文件夹s来搜寻，此参数将不会继续深入搜寻此文件夹
例:显示在/usr/users/tongxl目录下被程序正在打开的文件(如下所示)
# lsof +d /usr/users/tongxl
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
ksh 26946 root cwd VDIR8,6 512 51281 /usr/users/tongxl/c
a.out 26953 root cwd VDIR8,6 512 51281 /usr/users/tongxl/c
+D D 同上，但是会搜索目录下的目录，时间较长。（注意︰lsof以此参数进行时，须花费较多的动态记忆体。尤其在处理较大的文件夹时，请务必审慎使用之。）
例:显示在/usr/local/文件夹下被程序正在打开的文件(如下)很明显可以看出二者的差别
# lsof +D /usr/users/tongxl
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
ksh 26946 root cwd VDIR8,6 512 51281 /usr/users/tongxl/c
a.out 26953 root cwd VDIR8,6 512 51281 /usr/users/tongxl/c
a.out 26953 root txt VREG8,624576 51311 /usr/users/tongxl/c/a.out
-d s 此参数以file descriptor (FD)值显示结果，可以采用范围表示，如 1-3 或 3-10 但 最前面的数一定要比最后面的数小。
举例:以FD为4显示
# lsof -d 4
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
syslogd 147 root4u inet 0x1fe0b980 0t0UDP *:syslog
binlogd 151 root4u inet 0x1fe0bd40 0t0UDP *:*
portmap 319 root4u inet 0x1fe0b740 0t0UDP *:111
mountd321 root4u VREG8,6 253 22516 /usr (/dev/rz0g)
nfsd 323 root4u inet 0x0c349e00 0t0TCP *:2049 (LISTEN)
rpc.statd 330 root4u inet 0x1ab42000 0t0TCP xpp3:1024 (LISTEN)
rpc.lockd 332 root4u inet 0x1fe0bbc0 0t0UDP xpp3:1028
snmpd 449 root4u unix 0x1aaf6500 0t0/var/esnmp/esnmpd
svrMgt_mi 457 root4r VREG8,00 3424 / (/dev/rz0a)
os_mibs 458 root4u inet 0x1ab475c0 0t0UDP *:*
cpq_mibs 460 root4u unix 0x1aaf77c0 0t0/var/esnmp/esnmp_sub460
advfsd472 root4u inet 0x0c320000 0t0TCP *:AdvFS (LISTEN)
insightd 475 root4r VDIR8,6 512 25610 /usr (/dev/rz0g)
inetd 506 root4u inet 0x1ab26700 0t0TCP *:ftp (LISTEN)
lpd 567 root4wW VREG8,64 451219 /usr (/dev/rz0g)
dtlogin 605 root4w VREG8,64 344028 /usr (/dev/rz0g)
Xdec 616 root4w VREG8,64 344028 /usr (/dev/rz0g)
sendmail 702 root4u inet 0x0c321900 0t0TCP *:smtp (LISTEN)
dtlogin 891 root4w VREG8,64 344028 /usr (/dev/rz0g)
dxconsole 907 root4w VREG8,64 344028 /usr (/dev/rz0g)
dtgreet 908 root4w VREG8,64 344028 /usr (/dev/rz0g)
-g [s] 以程序的PGID (process group IDentification)显示，也可以采用范围(1-3)或个别(3,5)表示，若没有特别指定，则显示全部。
举例:以PGID为3显示
# lsof -g 3
COMMAND PID PGID USER FD TYPE DEVICE SIZE/OFF NODE NAME
kloadsrv 33 root cwd VDIR8,0 2560 2 /
kloadsrv 33 root txt VREG8,0 221184 16041 /sbin/kloadsrv
kloadsrv 33 root0r VCHR0,0 0t0 9608 /dev/console
kloadsrv 33 root1w VCHR0,0 0t0 9608 /dev/console
kloadsrv 33 root2w VCHR0,0 0t0 9608 /dev/console
-i [i] 用以监听有关的任何符合的位址。若没有相关位置被指定，则监听全部。
语法: lsof -i[46] [protocol][@hostname|hostaddr][:service|port]
46 --> IPv4 or IPv6
protocol --> TCP or UDP
hostname --> Internet host name
hostaddr --> IPv4位置
service --> /etc/service中的 service name (可以不只一个)
port --> 埠号 (可以不只一个)
# lsof -i tcp@xp001
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
telnetd 26862 root0u inet 0x0c349000 0t0 TCP xpp3:telnet->xp001:3807 (ESTABLISHED)
telnetd 26862 root1u inet 0x0c349000 0t0 TCP xpp3:telnet->xp001:3807 (ESTABLISHED)
telnetd 26862 root2u inet 0x0c349000 0t0 TCP xpp3:telnet->xp001:3807 (ESTABLISHED)
telnetd 26986 root0u inet 0x1ab27100 0t0 TCP xpp3:telnet->xp001:3988 (ESTABLISHED)
telnetd 26986 root1u inet 0x1ab27100 0t0 TCP xpp3:telnet->xp001:3988 (ESTABLISHED)
telnetd 26986 root2u inet 0x1ab27100 0t0 TCP xpp3:telnet->xp001:3988 (ESTABLISHED)
-l此参数禁止将user ID转换为登入名称。(预设显示登入名称)
# lsof -l|more
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
kernel0 0 cwd VDIR8,02560 2 /
init 1 0 cwd VDIR8,02560 2 /
init 1 0 txt VREG8,0 286720 16015 / (/dev/rz0a)
kloadsrv 3 0 cwd VDIR8,02560 2 /
kloadsrv 3 0 txt VREG8,0 221184 16041 /sbin/kloadsrv
kloadsrv 3 0 0r VCHR0,0 0t0 9608 /dev/console
kloadsrv 3 0 1w VCHR0,0 0t0 9608 /dev/console
kloadsrv 3 0 2w VCHR0,0 0t0 9608 /dev/console
+|-L [l] +或-表示正在打开或取消显示文件连结数. 若只有单纯的+L，后面没有任何数字，则表示显示全部。若其后有加上数字，只有文件连结数少于该数字的会被列出。
-n不将IP位址转换成hostname，预设是不加上-n参数。
举例: lsof -i tcp@xp001 -n
(您可以和上两张图比较一下，原先的hostname便回ip位置了)
# lsof -i tcp@xp001 -n
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
telnetd 26862 root0u inet 0x0c349000 0t0 TCP 10.65.69.147:telnet->10.65.69.131:3807 (ESTABLISHED)
telnetd 26862 root1u inet 0x0c349000 0t0 TCP 10.65.69.147:telnet->10.65.69.131:3807 (ESTABLISHED)
telnetd 26862 root2u inet 0x0c349000 0t0 TCP 10.65.69.147:telnet->10.65.69.131:3807 (ESTABLISHED)
telnetd 26986 root0u inet 0x1ab27100 0t0 TCP 10.65.69.147:telnet->10.65.69.131:3988 (ESTABLISHED)
telnetd 26986 root1u inet 0x1ab27100 0t0 TCP 10.65.69.147:telnet->10.65.69.131:3988 (ESTABLISHED)
telnetd 26986 root2u inet 0x1ab27100 0t0 TCP 10.65.69.147:telnet->10.65.69.131:3988 (ESTABLISHED)
# lsof -i tcp@xp001
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
telnetd 26862 root0u inet 0x0c349000 0t0 TCP xpp3:telnet->xp001:3807 (ESTABLISHED)
telnetd 26862 root1u inet 0x0c349000 0t0 TCP xpp3:telnet->xp001:3807 (ESTABLISHED)
telnetd 26862 root2u inet 0x0c349000 0t0 TCP xpp3:telnet->xp001:3807 (ESTABLISHED)
telnetd 26986 root0u inet 0x1ab27100 0t0 TCP xpp3:telnet->xp001:3988 (ESTABLISHED)
telnetd 26986 root1u inet 0x1ab27100 0t0 TCP xpp3:telnet->xp001:3988 (ESTABLISHED)
telnetd 26986 root2u inet 0x1ab27100 0t0 TCP xpp3:telnet->xp001:3988 (ESTABLISHED)
-s列出文件的大小，若该文件没有大小，则留下空白。
# lsof -s
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
kernel0 root cwd VDIR8,0 2560 2 /
init 1 root cwd VDIR8,0 2560 2 /
init 1 root txt VREG8,0 286720 16015 / (/dev/rz0a)
kloadsrv 3 root cwd VDIR8,0 2560 2 /
kloadsrv 3 root txt VREG8,0 221184 16041 /sbin/kloadsrv
kloadsrv 3 root0r VCHR0,09608 /dev/console
kloadsrv 3 root1w VCHR0,09608 /dev/console
kloadsrv 3 root2w VCHR0,09608 /dev/console
-u s 以login name(登入名称)或UID，列出所正在打开文件。
# lsof -u tongxl
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
csh 26939 tongxl cwd VDIR8,6 1024 243236 /usr -- tongxl
csh 26939 tongxl txt VREG8,6 253952 12856 /usr (/dev/rz0g)
csh 26939 tongxl txt VREG8,0 139264 16016 /sbin/loader
csh 26939 tongxl txt VREG8,0 1663104 38402 /shlib/libc.so
csh 26939 tongxl0r VCHR1,0 0t0 9612 /dev/tty
csh 26939 tongxl 15u VCHR6,20t328 9618 /dev/pts/2
csh 26939 tongxl 16u VCHR6,20t328 9618 /dev/pts/2
csh 26939 tongxl 17u VCHR6,20t328 9618 /dev/pts/2
csh 26939 tongxl 18u VCHR6,20t328 9618 /dev/pts/2
csh 26939 tongxl 19u VCHR6,20t328 9618 /dev/pts/2
csh 26990 tongxl cwd VDIR8,6 1024 243236 /usr -- tongxl
csh 26990 tongxl txt VREG8,6 253952 12856 /usr (/dev/rz0g)
csh 26990 tongxl txt VREG8,0 139264 16016 /sbin/loader
csh 26990 tongxl txt VREG8,0 1663104 38402 /shlib/libc.so
csh 26990 tongxl0r VCHR1,0 0t0 9612 /dev/tty
csh 26990 tongxl 15u VCHR6,1 0t147797 9616 /dev/pts/1
csh 26990 tongxl 16u VCHR6,1 0t147797 9616 /dev/pts/1
csh 26990 tongxl 17u VCHR6,1 0t147797 9616 /dev/pts/1
csh 26990 tongxl 18u VCHR6,1 0t147797 9616 /dev/pts/1
csh 26990 tongxl 19u VCHR6,1 0t147797 9616 /dev/pts/1
三、结束语
上面介绍的LSOF 4.74诊断和分析工具，只是众多优秀的网络安全工具中一种，在tru 64上的成功安装和使用，对于提高系统的安全性和管理系统有很大的好处。其它的操作系统也可参考本文。如果你感觉对你有帮助的话就顶一下，如果你觉得有不足之处请指出来。总之，希望大家喜欢了。
