Since lsof reads kernel memory in its search for open files,
rapid changes in kernel memory may produce unpredictable results.
When a file has multiple record locks, the lock status character
(following the file descriptor) is derived from a test of the
first lock structure, not from any combination of the individual
record locks that might be described by multiple lock structures.
Lsof can't search for files with restrictive access permissions
by name unless it is installed with root set-UID permission.
Otherwise it is limited to searching for files to which its user
or its set-GID group (if any) has access permission.
The display of the destination address of a raw socket (e.g., for
ping) depends on the UNIX operating system. Some dialects store
the destination address in the raw socket's protocol control
block, some do not.
Lsof can't always represent Solaris device numbers in the same
way that ls(1) does. For example, the major and minor device
numbers that the lstat(2) and stat(2) functions report for the
directory on which CD-ROM files are mounted (typically /cdrom)
are not the same as the ones that it reports for the device on
which CD-ROM files are mounted (typically /dev/sr0). (Lsof
reports the directory numbers.)
The support for /proc file systems is available only for BSD and
Tru64 UNIX dialects, Linux, and dialects derived from SYSV R4 -
e.g., FreeBSD, NetBSD, OpenBSD, Solaris, UnixWare.
Some /proc file items - device number, inode number, and file
size - are unavailable in some dialects. Searching for files in
a /proc file system may require that the full path name be
specified.
No text (txt) file descriptors are displayed for Linux processes.
All entries for files other than the current working directory,
the root directory, and numerical file descriptors are labeled
mem descriptors.
Lsof can't search for Tru64 UNIX named pipes by name, because
their kernel implementation of lstat(2) returns an improper
device number for a named pipe.
Lsof can't report fully or correctly on HP-UX 9.01, 10.20, and
11.00 locks because of insufficient access to kernel data or
errors in the kernel data. See the lsof FAQ (The FAQ section
gives its location.) for details.
The AIX SMT file type is a fabrication. It's made up for file
structures whose type (15) isn't defined in the AIX
/usr/include/sys/file.h header file. One way to create such file
structures is to run X clients with the DISPLAY variable set to
``:0.0''.
The +|-f[cfgGn] option is not supported under /proc-based Linux
lsof, because it doesn't read kernel structures from kernel
memory.
