This section describes the information lsof lists for each open
file. See the OUTPUT FOR OTHER PROGRAMS section for additional
information on output that can be processed by another program.
Lsof only outputs printable (declared so by isprint(3)) 8 bit
characters. Non-printable characters are printed in one of three
forms: the C ``\[bfrnt]'' form; the control character `^' form
(e.g., ``^@''); or hexadecimal leading ``\x'' form (e.g.,
``\xab''). Space is non-printable in the COMMAND column
(``\x20'') and printable elsewhere.
For some dialects - if HASSETLOCALE is defined in the dialect's
machine.h header file - lsof will print the extended 8 bit
characters of a language locale. The lsof process must be
supplied a language locale environment variable (e.g., LANG)
whose value represents a known language locale in which the
extended characters are considered printable by isprint(3).
Otherwise lsof considers the extended characters non-printable
and prints them according to its rules for non-printable
characters, stated above. Consult your dialect's setlocale(3)
man page for the names of other environment variables that may be
used in place of LANG - e.g., LC_ALL, LC_CTYPE, etc.
Lsof's language locale support for a dialect also covers wide
characters - e.g., UTF-8 - when HASSETLOCALE and HASWIDECHAR are
defined in the dialect's machine.h header file, and when a
suitable language locale has been defined in the appropriate
environment variable for the lsof process. Wide characters are
printable under those conditions if iswprint(3) reports them to
be. If HASSETLOCALE, HASWIDECHAR and a suitable language locale
aren't defined, or if iswprint(3) reports wide characters that
aren't printable, lsof considers the wide characters
non-printable and prints each of their 8 bits according to its
rules for non-printable characters, stated above.
Consult the answers to the "Language locale support" questions in
the lsof FAQ (The FAQ section gives its location.) for more
information.
Lsof dynamically sizes the output columns each time it runs,
guaranteeing that each column is a minimum size. It also
guarantees that each column is separated from its predecessor by
at least one space.
COMMAND
contains the first nine characters of the name of the UNIX
command associated with the process. If a non-zero w
value is specified to the +c w option, the column contains
the first w characters of the name of the UNIX command
associated with the process up to the limit of characters
supplied to lsof by the UNIX dialect. (See the
description of the +c w command or the lsof FAQ for more
information. The FAQ section gives its location.)
If w is less than the length of the column title,
``COMMAND'', it will be raised to that length.
If a zero w value is specified to the +c w option, the
column contains all the characters of the name of the UNIX
command associated with the process.
All command name characters maintained by the kernel in
its structures are displayed in field output when the
command name descriptor (`c') is specified. See the
OUTPUT FOR OTHER COMMANDS section for information on
selecting field output and the associated command name
descriptor.
PID is the Process IDentification number of the process.
TID is the task (thread) IDentification number, if task
(thread) reporting is supported by the dialect and a task
(thread) is being listed. (If help output - i.e., the
output of the -h or -? options - shows this option, then
task (thread) reporting is supported by the dialect.)
A blank TID column in Linux indicates a process - i.e., a
non-task.
TASKCMD
is the task command name. Generally this will be the same
as the process named in the COMMAND column, but some task
implementations (e.g., Linux) permit a task to change its
command name.
The TASKCMD column width is subject to the same size
limitation as the COMMAND column.
ZONE is the Solaris 10 and higher zone name. This column must
be selected with the -z option.
SECURITY-CONTEXT
is the SELinux security context. This column must be
selected with the -Z option. Note that the -Z option is
inhibited when SELinux is disabled in the running Linux
kernel.
PPID is the Parent Process IDentification number of the
process. It is only displayed when the -R option has been
specified.
PGID is the process group IDentification number associated with
the process. It is only displayed when the -g option has
been specified.
USER is the user ID number or login name of the user to whom
the process belongs, usually the same as reported by
ps(1). However, on Linux USER is the user ID number or
login that owns the directory in /proc where lsof finds
information about the process. Usually that is the same
value reported by ps(1), but may differ when the process
has changed its effective user ID. (See the -l option
description for information on when a user ID number or
login name is displayed.)
FD is the File Descriptor number of the file or:
cwd current working directory;
Lnn library references (AIX);
err FD information error (see NAME column);
jld jail directory (FreeBSD);
ltx shared library text (code and data);
Mxx hex memory-mapped type number xx.
m86 DOS Merge mapped file;
mem memory-mapped file;
mmap memory-mapped device;
pd parent directory;
rtd root directory;
tr kernel trace file (OpenBSD);
txt program text (code and data);
v86 VP/ix mapped file;
FD is followed by one of these characters, describing the
mode under which the file is open:
r for read access;
w for write access;
u for read and write access;
space if mode unknown and no lock
character follows;
`-' if mode unknown and lock
character follows.
The mode character is followed by one of these lock
characters, describing the type of lock applied to the
file:
N for a Solaris NFS lock of unknown type;
r for read lock on part of the file;
R for a read lock on the entire file;
w for a write lock on part of the file;
W for a write lock on the entire file;
u for a read and write lock of any length;
U for a lock of unknown type;
x for an SCO OpenServer Xenix lock on part of
the file;
X for an SCO OpenServer Xenix lock on the entire
file;
space if there is no lock.
See the LOCKS section for more information on the lock
information character.
The FD column contents constitutes a single field for
parsing in post-processing scripts.
TYPE is the type of the node associated with the file - e.g.,
GDIR, GREG, VDIR, VREG, etc.
or ``IPv4'' for an IPv4 socket;
or ``IPv6'' for an open IPv6 network file - even if its
address is IPv4, mapped in an IPv6 address;
or ``ax25'' for a Linux AX.25 socket;
or ``inet'' for an Internet domain socket;
or ``lla'' for a HP-UX link level access file;
or ``rte'' for an AF_ROUTE socket;
or ``sock'' for a socket of unknown domain;
or ``unix'' for a UNIX domain socket;
or ``x.25'' for an HP-UX x.25 socket;
or ``BLK'' for a block special file;
or ``CHR'' for a character special file;
or ``DEL'' for a Linux map file that has been deleted;
or ``DIR'' for a directory;
or ``DOOR'' for a VDOOR file;
or ``FIFO'' for a FIFO special file;
or ``KQUEUE'' for a BSD style kernel event queue file;
or ``LINK'' for a symbolic link file;
or ``MPB'' for a multiplexed block file;
or ``MPC'' for a multiplexed character file;
or ``NOFD'' for a Linux /proc/<PID>/fd directory that
can't be opened -- the directory path appears in the NAME
column, followed by an error message;
or ``PAS'' for a /proc/as file;
or ``PAXV'' for a /proc/auxv file;
or ``PCRE'' for a /proc/cred file;
or ``PCTL'' for a /proc control file;
or ``PCUR'' for the current /proc process;
or ``PCWD'' for a /proc current working directory;
or ``PDIR'' for a /proc directory;
or ``PETY'' for a /proc executable type (etype);
or ``PFD'' for a /proc file descriptor;
or ``PFDR'' for a /proc file descriptor directory;
or ``PFIL'' for an executable /proc file;
or ``PFPR'' for a /proc FP register set;
or ``PGD'' for a /proc/pagedata file;
or ``PGID'' for a /proc group notifier file;
or ``PIPE'' for pipes;
or ``PLC'' for a /proc/lwpctl file;
or ``PLDR'' for a /proc/lpw directory;
or ``PLDT'' for a /proc/ldt file;
or ``PLPI'' for a /proc/lpsinfo file;
or ``PLST'' for a /proc/lstatus file;
or ``PLU'' for a /proc/lusage file;
or ``PLWG'' for a /proc/gwindows file;
or ``PLWI'' for a /proc/lwpsinfo file;
or ``PLWS'' for a /proc/lwpstatus file;
or ``PLWU'' for a /proc/lwpusage file;
or ``PLWX'' for a /proc/xregs file;
or ``PMAP'' for a /proc map file (map);
or ``PMEM'' for a /proc memory image file;
or ``PNTF'' for a /proc process notifier file;
or ``POBJ'' for a /proc/object file;
or ``PODR'' for a /proc/object directory;
or ``POLP'' for an old format /proc light weight process
file;
or ``POPF'' for an old format /proc PID file;
or ``POPG'' for an old format /proc page data file;
or ``PORT'' for a SYSV named pipe;
or ``PREG'' for a /proc register file;
or ``PRMP'' for a /proc/rmap file;
or ``PRTD'' for a /proc root directory;
or ``PSGA'' for a /proc/sigact file;
or ``PSIN'' for a /proc/psinfo file;
or ``PSTA'' for a /proc status file;
or ``PSXSEM'' for a POSIX semaphore file;
or ``PSXSHM'' for a POSIX shared memory file;
or ``PTS'' for a /dev/pts file;
or ``PUSG'' for a /proc/usage file;
or ``PW'' for a /proc/watch file;
or ``PXMP'' for a /proc/xmap file;
or ``REG'' for a regular file;
or ``SMT'' for a shared memory transport file;
or ``STSO'' for a stream socket;
or ``UNNM'' for an unnamed type file;
or ``XNAM'' for an OpenServer Xenix special file of
unknown type;
or ``XSEM'' for an OpenServer Xenix semaphore file;
or ``XSD'' for an OpenServer Xenix shared data file;
or the four type number octets if the corresponding name
isn't known.
FILE-ADDR
contains the kernel file structure address when f has been
specified to +f;
FCT contains the file reference count from the kernel file
structure when c has been specified to +f;
FILE-FLAG
when g or G has been specified to +f, this field contains
the contents of the f_flag[s] member of the kernel file
structure and the kernel's per-process open file flags (if
available); `G' causes them to be displayed in
hexadecimal; `g', as short-hand names; two lists may be
displayed with entries separated by commas, the lists
separated by a semicolon (`;'); the first list may contain
short-hand names for f_flag[s] values from the following
table:
AIO asynchronous I/O (e.g., FAIO)
AP append
ASYN asynchronous I/O (e.g., FASYNC)
BAS block, test, and set in use
BKIU block if in use
BL use block offsets
BSK block seek
CA copy avoid
CIO concurrent I/O
CLON clone
CLRD CL read
CR create
DF defer
DFI defer IND
DFLU data flush
DIR direct
DLY delay
DOCL do clone
DSYN data-only integrity
DTY must be a directory
EVO event only
EX open for exec
EXCL exclusive open
FSYN synchronous writes
GCDF defer during unp_gc() (AIX)
GCMK mark during unp_gc() (AIX)
GTTY accessed via /dev/tty
HUP HUP in progress
KERN kernel
KIOC kernel-issued ioctl
LCK has lock
LG large file
MBLK stream message block
MK mark
MNT mount
MSYN multiplex synchronization
NATM don't update atime
NB non-blocking I/O
NBDR no BDRM check
NBIO SYSV non-blocking I/O
NBF n-buffering in effect
NC no cache
ND no delay
NDSY no data synchronization
NET network
NFLK don't follow links
NMFS NM file system
NOTO disable background stop
NSH no share
NTTY no controlling TTY
OLRM OLR mirror
PAIO POSIX asynchronous I/O
PP POSIX pipe
R read
RC file and record locking cache
REV revoked
RSH shared read
RSYN read synchronization
RW read and write access
SL shared lock
SNAP cooked snapshot
SOCK socket
SQSH Sequent shared set on open
SQSV Sequent SVM set on open
SQR Sequent set repair on open
SQS1 Sequent full shared open
SQS2 Sequent partial shared open
STPI stop I/O
SWR synchronous read
SYN file integrity while writing
TCPM avoid TCP collision
TR truncate
W write
WKUP parallel I/O synchronization
WTG parallel I/O synchronization
VH vhangup pending
VTXT virtual text
XL exclusive lock
this list of names was derived from F* #define's in
dialect header files <fcntl.h>, <linux</fs.h>,
<sys/fcntl.c>, <sys/fcntlcom.h>, and <sys/file.h>; see the
lsof.h header file for a list showing the correspondence
between the above short-hand names and the header file
definitions;
the second list (after the semicolon) may contain
short-hand names for kernel per-process open file flags
from this table:
ALLC allocated
BR the file has been read
BHUP activity stopped by SIGHUP
BW the file has been written
CLSG closing
CX close-on-exec (see fcntl(F_SETFD))
LCK lock was applied
MP memory-mapped
OPIP open pending - in progress
RSVW reserved wait
SHMT UF_FSHMAT set (AIX)
USE in use (multi-threaded)
NODE-ID
(or INODE-ADDR for some dialects) contains a unique
identifier for the file node (usually the kernel vnode or
inode address, but also occasionally a concatenation of
device and node number) when n has been specified to +f;
DEVICE contains the device numbers, separated by commas, for a
character special, block special, regular, directory or
NFS file;
or ``memory'' for a memory file system node under Tru64
UNIX;
or the address of the private data area of a Solaris
socket stream;
or a kernel reference address that identifies the file
(The kernel reference address may be used for FIFO's, for
example.);
or the base address or device name of a Linux AX.25 socket
device.
Usually only the lower thirty two bits of Tru64 UNIX
kernel addresses are displayed.
SIZE, SIZE/OFF, or OFFSET
is the size of the file or the file offset in bytes. A
value is displayed in this column only if it is available.
Lsof displays whatever value - size or offset - is
appropriate for the type of the file and the version of
lsof.
On some UNIX dialects lsof can't obtain accurate or
consistent file offset information from its kernel data
sources, sometimes just for particular kinds of files
(e.g., socket files.) In other cases, files don't have
true sizes - e.g., sockets, FIFOs, pipes - so lsof
displays for their sizes the content amounts it finds in
their kernel buffer descriptors (e.g., socket buffer size
counts or TCP/IP window sizes.) Consult the lsof FAQ (The
FAQ section gives its location.) for more information.
The file size is displayed in decimal; the offset is
normally displayed in decimal with a leading ``0t'' if it
contains 8 digits or less; in hexadecimal with a leading
``0x'' if it is longer than 8 digits. (Consult the -o o
option description for information on when 8 might default
to some other value.)
Thus the leading ``0t'' and ``0x'' identify an offset when
the column may contain both a size and an offset (i.e.,
its title is SIZE/OFF).
If the -o option is specified, lsof always displays the
file offset (or nothing if no offset is available) and
labels the column OFFSET. The offset always begins with
``0t'' or ``0x'' as described above.
The lsof user can control the switch from ``0t'' to ``0x''
with the -o o option. Consult its description for more
information.
If the -s option is specified, lsof always displays the
file size (or nothing if no size is available) and labels
the column SIZE. The -o and -s options are mutually
exclusive; they can't both be specified.
For files that don't have a fixed size - e.g., don't
reside on a disk device - lsof will display appropriate
information about the current size or position of the file
if it is available in the kernel structures that define
the file.
NLINK contains the file link count when +L has been specified;
NODE is the node number of a local file;
or the inode number of an NFS file in the server host;
or the Internet protocol type - e.g, ``TCP'';
or ``STR'' for a stream;
or ``CCITT'' for an HP-UX x.25 socket;
or the IRQ or inode number of a Linux AX.25 socket device.
NAME is the name of the mount point and file system on which
the file resides;
or the name of a file specified in the names option (after
any symbolic links have been resolved);
or the name of a character special or block special
device;
or the local and remote Internet addresses of a network
file; the local host name or IP number is followed by a
colon (':'), the port, ``->'', and the two-part remote
address; IP addresses may be reported as numbers or names,
depending on the +|-M, -n, and -P options; colon-separated
IPv6 numbers are enclosed in square brackets; IPv4
INADDR_ANY and IPv6 IN6_IS_ADDR_UNSPECIFIED addresses, and
zero port numbers are represented by an asterisk ('*'); a
UDP destination address may be followed by the amount of
time elapsed since the last packet was sent to the
destination; TCP, UDP and UDPLITE remote addresses may be
followed by TCP/TPI information in parentheses - state
(e.g., ``(ESTABLISHED)'', ``(Unbound)''), queue sizes, and
window sizes (not all dialects) - in a fashion similar to
what netstat(1) reports; see the -T option description or
the description of the TCP/TPI field in OUTPUT FOR OTHER
PROGRAMS for more information on state, queue size, and
window size;
or the address or name of a UNIX domain socket, possibly
including a stream clone device name, a file system
object's path name, local and foreign kernel addresses,
socket pair information, and a bound vnode address;
or the local and remote mount point names of an NFS file;
or ``STR'', followed by the stream name;
or a stream character device name, followed by ``->'' and
the stream name or a list of stream module names,
separated by ``->'';
or ``STR:'' followed by the SCO OpenServer stream device
and module names, separated by ``->'';
or system directory name, `` -- '', and as many components
of the path name as lsof can find in the kernel's name
cache for selected dialects (See the KERNEL NAME CACHE
section for more information.);
or ``PIPE->'', followed by a Solaris kernel pipe
destination address;
or ``COMMON:'', followed by the vnode device information
structure's device name, for a Solaris common vnode;
or the address family, followed by a slash (`/'), followed
by fourteen comma-separated bytes of a non-Internet raw
socket address;
or the HP-UX x.25 local address, followed by the virtual
connection number (if any), followed by the remote address
(if any);
or ``(dead)'' for disassociated Tru64 UNIX files -
typically terminal files that have been flagged with the
TIOCNOTTY ioctl and closed by daemons;
or ``rd=<offset>'' and ``wr=<offset>'' for the values of
the read and write offsets of a FIFO;
or ``clone n:/dev/event'' for SCO OpenServer file clones
of the /dev/event device, where n is the minor device
number of the file;
or ``(socketpair: n)'' for a Solaris 2.6, 8, 9 or 10 UNIX
domain socket, created by the socketpair(3N) network
function;
or ``no PCB'' for socket files that do not have a protocol
block associated with them, optionally followed by ``,
CANTSENDMORE'' if sending on the socket has been disabled,
or ``, CANTRCVMORE'' if receiving on the socket has been
disabled (e.g., by the shutdown(2) function);
or the local and remote addresses of a Linux IPX socket
file in the form <net>:[<node>:]<port>, followed in
parentheses by the transmit and receive queue sizes, and
the connection state;
or ``dgram'' or ``stream'' for the type UnixWare 7.1.1 and
above in-kernel UNIX domain sockets, followed by a colon
(':') and the local path name when available, followed by
``->'' and the remote path name or kernel socket address
in hexadecimal when available;
or the association value, association index, endpoint
value, local address, local port, remote address and
remote port for Linux SCTP sockets;
or ``protocol: '' followed by the Linux socket's protocol
attribute.
For dialects that support a ``namefs'' file system, allowing one
file to be attached to another with fattach(3C), lsof will add
``(FA:<address1><direction><address2>)'' to the NAME column.
<address1> and <address2> are hexadecimal vnode addresses.
<direction> will be ``<-'' if <address2> has been fattach'ed to
this vnode whose address is <address1>; and ``->'' if <address1>,
the vnode address of this vnode, has been fattach'ed to
<address2>. <address1> may be omitted if it already appears in
the DEVICE column.
Lsof may add two parenthetical notes to the NAME column for open
Solaris 10 files: ``(?)'' if lsof considers the path name of
questionable accuracy; and ``(deleted)'' if the -X option has
been specified and lsof detects the open file's path name has
been deleted. Consult the lsof FAQ (The FAQ section gives its
location.) for more information on these NAME column additions.
