![如何解释 lsof 命令的输出?](https://linux22.com/image/44398/%E5%A6%82%E4%BD%95%E8%A7%A3%E9%87%8A%20lsof%20%E5%91%BD%E4%BB%A4%E7%9A%84%E8%BE%93%E5%87%BA%EF%BC%9F.png)
root@host [/home2]# lsof /home2
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
php 3182 ctxmortg cwd DIR 8,17 4096 32858196 /home2/ctxmortg/public_html/hello
php 3182 ctxmortg 3r REG 8,17 46404 55781766 /home2/ctxmortg/public_html/hello/cache/subprimemortgagemorgage.com/cache-zch-8284-cache.txt
php 3185 ctxmortg cwd DIR 8,17 4096 32858196 /home2/ctxmortg/public_html/hello
php 3185 ctxmortg 3r REG 8,17 4185 35962154 /home2/ctxmortg/public_html/hello/cache/curl/http%3A%2F%2Fimage.yahoo.cn%2Fs%3Fq%3DNudity%26c%3D0%26s%3D%26page%3D277
php 3187 ctxmortg cwd DIR 8,17 4096 32858196 /home2/ctxmortg/public_html/hello
php 3187 ctxmortg 3r REG 8,17 54640 69699731 /home2/ctxmortg/public_html/hello/cache/newdatingfriends.com/cache-zch-1545-cache.txt
php 3188 ctxmortg cwd DIR 8,17 4096 32858196 /home2/ctxmortg/public_html/hello
php 3188 ctxmortg 3r REG 8,17 54640 21557063 /home2/ctxmortg/public_html/hello/cache/customersdeals.com/cache-zch-5715-cache.txt
php 3189 ctxmortg cwd DIR 8,17 4096 32858196 /home2/ctxmortg/public_html/hello
php 3189 ctxmortg 3r REG 8,17 4185 36028071 /home2/ctxmortg/public_html/hello/cache/curl/http%3A%2F%2Fimage.yahoo.cn%2Fs%3Fq%3DVideos%26c%3D0%26s%3D%26page%3D329
php 3200 ctxmortg cwd DIR 8,17 4096 32858196 /home2/ctxmortg/public_html/hello
php 3200 ctxmortg 3r REG 8,17 21036 9155614 /home2/ctxmortg/public_html/hello/cache/indorealestates.com/cache-zch-8562-cache.txt
lsof 3201 root cwd DIR 8,17 4096 2 /home2
lsof 3202 root cwd DIR 8,17 4096 2 /home2
webalizer 32342 ctxmortg cwd DIR 8,17 4096 32890953 /home2/ctxmortg/tmp/webalizer/eyebestdatedotcomauph.ctxmortgagemortgagerefi.com
webalizer 32342 ctxmortg 5uW REG 8,17 12288 32890954 /home2/ctxmortg/tmp/webalizer/eyebestdatedotcomauph.ctxmortgagemortgagerefi.com/dns_cache.db
webalizer 32360 ctxmortg cwd DIR 8,17 4096 32890953 /home2/ctxmortg/tmp/webalizer/eyebestdatedotcomauph.ctxmortgagemortgagerefi.com
webalizer 32360 ctxmortg 5u REG 8,17 12288 32890954 /home2/ctxmortg/tmp/webalizer/eyebestdatedotcomauph.ctxmortgagemortgagerefi.com/dns_cache.db
webalizer 32361 ctxmortg cwd DIR 8,17 4096 32890953 /home2/ctxmortg/tmp/webalizer/eyebestdatedotcomauph.ctxmortgagemortgagerefi.com
webalizer 32361 ctxmortg 5u REG 8,17 12288 32890954 /home2/ctxmortg/tmp/webalizer/eyebestdatedotcomauph.ctxmortgagemortgagerefi.com/dns_cache.db
webalizer 32362 ctxmortg cwd DIR 8,17 4096 32890953 /home2/ctxmortg/tmp/webalizer/eyebestdatedotcomauph.ctxmortgagemortgagerefi.com
webalizer 32362 ctxmortg 5u REG 8,17 12288 32890954 /home2/ctxmortg/tmp/webalizer/eyebestdatedotcomauph.ctxmortgagemortgagerefi.com/dns_cache.db
webalizer 32363 ctxmortg cwd DIR 8,17 4096 32890953 /home2/ctxmortg/tmp/webalizer/eyebestdatedotcomauph.ctxmortgagemortgagerefi.com
webalizer 32363 ctxmortg 5u REG 8,17 12288 32890954 /home2/ctxmortg/tmp/webalizer/eyebestdatedotcomauph.ctxmortgagemortgagerefi.com/dns_cache.db
webalizer 32364 ctxmortg cwd DIR 8,17 4096 32890953 /home2/ctxmortg/tmp/webalizer/eyebestdatedotcomauph.ctxmortgagemortgagerefi.com
webalizer 32364 ctxmortg 5u REG 8,17 12288 32890954 /home2/ctxmortg/tmp/webalizer/eyebestdatedotcomauph.ctxmortgagemortgagerefi.com/dns_cache.db
webalizer 32365 ctxmortg cwd DIR 8,17 4096 32890953 /home2/ctxmortg/tmp/webalizer/eyebestdatedotcomauph.ctxmortgagemortgagerefi.com
webalizer 32365 ctxmortg 5u REG 8,17 12288 32890954 /home2/ctxmortg/tmp/webalizer/eyebestdatedotcomauph.ctxmortgagemortgagerefi.com/dns_cache.db
webalizer 32366 ctxmortg cwd DIR 8,17 4096 32890953 /home2/ctxmortg/tmp/webalizer/eyebestdatedotcomauph.ctxmortgagemortgagerefi.com
webalizer 32366 ctxmortg 5u REG 8,17 12288 32890954 /home2/ctxmortg/tmp/webalizer/eyebestdatedotcomauph.ctxmortgagemortgagerefi.com/dns_cache.db
webalizer 32367 ctxmortg cwd DIR 8,17 4096 32890953 /home2/ctxmortg/tmp/webalizer/eyebestdatedotcomauph.ctxmortgagemortgagerefi.com
webalizer 32367 ctxmortg 5u REG 8,17 12288 32890954 /home2/ctxmortg/tmp/webalizer/eyebestdatedotcomauph.ctxmortgagemortgagerefi.com/dns_cache.db
webalizer 32368 ctxmortg cwd DIR 8,17 4096 32890953 /home2/ctxmortg/tmp/webalizer/eyebestdatedotcomauph.ctxmortgagemortgagerefi.com
webalizer 32368 ctxmortg 5u REG 8,17 12288 32890954 /home2/ctxmortg/tmp/webalizer/eyebestdatedotcomauph.ctxmortgagemortgagerefi.com/dns_cache.db
webalizer 32369 ctxmortg cwd DIR 8,17 4096 32890953 /home2/ctxmortg/tmp/webalizer/eyebestdatedotcomauph.ctxmortgagemortgagerefi.com
webalizer 32369 ctxmortg 5u REG 8,17 12288 32890954 /home2/ctxmortg/tmp/webalizer/eyebestdatedotcomauph.ctxmortgagemortgagerefi.com/dns_cache.db
bash 32409 root cwd DIR 8,17 4096 2 /home2
我想卸载驱动器但不能。
那么,cwd、3r dir 和 reg 到底是什么意思呢?
答案1
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
webalizer 32342 ctxmortg 5uW REG 8,17 12288 32890954 /home2/ctxmortg/tmp/webalizer/eyebestdatedotcomauph.ctxmortgagemortgagerefi.com/dns_cache.db
FD——文件描述符
如果您正在查找正在写入的文件,请查找以下标志
# - The number in front of flag(s) is the file descriptor number of used by the process to associated with the file
u - File open with Read and Write permission
r - File open with Read permission
w - File open with Write permission
W - File open with Write permission and with Write Lock on entire file
mem - Memory mapped file, usually for share library
因此3r
意味着 webalizer 有一个与 关联的描述符编号 3 ...dns_cache.db
,具有读取权限。
类型 - 文件类型
在Linux中,几乎所有东西都是文件,只是类型不同。
REG - REGgular file, file that show up in directory
DIR - Directory
节点
文件系统中的索引节点号
您可以在以下位置找到完整的详细信息手册页。
答案2
有关各列含义的信息可以在 lsof(8) 联机帮助页中找到。我会专门针对您所询问的问题进行解答。
cwd => current working directory
3r => file descriptor 3 opened for reading
DIR => directory
REG => regular file
为了卸载驱动器,您可能需要停止您的网络服务器,并终止 webalizer 进程(因为它通常是从 cron 运行的批处理作业)。
答案3
在这种情况下,我通常将 lsof 与 ps 结合使用来找出谁正在使设备忙碌。
我们以安装为 /media/disk-1 的 U 盘为例
$> sudo umount /media/disk-1
[sudo] password for cj:
umount: /media/disk-1: device is busy.
(In some cases useful info about processes that use
the device is found by lsof(8) or fuser(1))
因此,我尝试使用 lsof 找出谁持有该设备。
$> lsof | grep disk-1
bash 7822 cj cwd DIR 8,33 16384 1 /media/disk-1
由于第 2 列是 pid,我们可以使用 ps 获取该进程的名称。
$> ps -A | grep 7822
7822 pts/1 00:00:00 bash
现在 bash 来自在设备上的目录中打开的终端,因此此时我可以关闭或终止该终端,以便设备再次空闲。
更新我不认为我回答了这个问题,但也许这对其他人有帮助,所以我还是离开了。