NAME¶

lsfd - list file descriptors

SYNOPSIS¶

lsfd [option]

DESCRIPTION¶

lsfd is intended to be a modern replacement for lsof(8) on Linux systems. Unlike lsof, lsfd is specialized to Linux kernel; it supports Linux specific features like namespaces with simpler code. lsfd is not a drop-in replacement for lsof; they are different in the command line interface and output formats.

The default output is subject to change. So whenever possible, you should avoid using default outputs in your scripts. Always explicitly define expected columns by using --output columns-list in environments where a stable output is required.

lsfd uses Libsmartcols for output formatting and filtering. See the description of --output option for customizing the output format, and --filter option for filtering. Use lsfd --list-columns to get a list of all available columns.

OPTIONS¶

-l, --threads

-J, --json

-n, --noheadings

-o, --output list

-r, --raw

--notruncate

-p, --pid pids

-i[4|6], --inet[=4|=6]

-Q, --filter expr

-C, --counter label:filter_expr

--summary[=when]

--debug-filter

--dump-counters

-H, --list-columns

-h, --help

-V, --version

OUTPUT COLUMNS¶

Each column has a type. Types are surround by < and >.

CAUTION: The names and types of columns are not stable yet. They may be changed in the future releases.

AINODECLASS <string>

ASSOC <string>

BLKDRV <string>

BPF-MAP.ID <number>

BPF-MAP.TYPE <string>

BPF-MAP.TYPE.RAW <number>

BPF.NAME <string>

BPF-PROG.ID <number>

BPF-PROG.TYPE <string>

BPF-PROG.TYPE.RAW <number>

CHRDRV <string>

COMMAND <string>

DELETED <boolean>

DEV <string>

DEVTYPE <string>

ENDPOINT <string>

EVENTFD.ID <number>

EVENTPOLL.TFDS <string>

FD <number>

FLAGS <string>

FUID <number>

INET.LADDR <string>

INET.RADDR <string>

INET6.LADDR <string>

INET6.RADDR <string>

INODE <number>

INOTIFY.INODES <string>

INOTIFY.INODES.RAW <string>

KNAME <string>

KTHREAD <boolean>

MAJ:MIN <string>

MAPLEN <number>

MISCDEV <string>

MNTID <number>

MODE <string>

NAME <string>

NETLINK.GROUPS <number>

NETLINK.LPORT <number>

NETLINK.PROTOCOL <string>

NLINK <number>

NS.NAME <string>

NS.TYPE <string>

OWNER <string>

PACKET.IFACE <string>

PACKET.PROTOCOL <string>

PARTITION <string>

PID <number>

PIDFD.COMM <string>

PIDFD.NSPID <string>

PIDFD.PID <number>

PING.ID <`number`>

POS <number>

RAW.PROTOCOL <number>

RDEV <string>

SIGNALFD.MASK <string>

SIZE <number>

SOCK.LISTENING <boolean>

SOCK.NETS <number>

SOCK.PROTONAME <string>

SOCK.SHUTDOWN <string>

SOCK.STATE <string>

SOCK.TYPE <string>

SOURCE <string>

STTYPE <string>

TCP.LADDR <string>

TCP.LPORT <number>

TCP.RADDR <string>

TCP.RPORT <number>

TID <number>

TIMERFD.CLOCKID <string>

TIMERFD.INTERVAL <number>

TIMERFD.REMAINING <number>

PTMX.TTY-INDEX <number>

TUN.IFACE <string>

TYPE <string>

UDP.LADDR <string>

UDP.LPORT <number>

UDP.RADDR <string>

UDP.RPORT <number>

UDPLITE.LADDR <string>

UDPLITE.LPORT <number>

UDPLITE.RADDR <string>

UDPLITE.RPORT <number>

UID <number>

UNIX.PATH <string>

USER <string>

XMODE <string>

FILTER EXAMPLES¶

lsfd has few options for filtering. In most of cases, what you should know is -Q (or --filter) option. Combined with -o (or --output) option, you can customize the output as you want.

List files associated with PID 1 and PID 2 processes:

# lsfd -Q '(PID == 1) or (PID == 2)'

Do the same in an alternative way:

# lsfd -Q '(PID == 1) || (PID == 2)'

Do the same in a more efficient way:

# lsfd --pid 1,2

Whitescapes can be used instead of a comma:

# lsfd --pid '1 2'

Utilize pidof(1) for list the files associated with "firefox":

# lsfd --pid "$(pidof firefox)"

List the 1st file descriptor opened by PID 1 process:

# lsfd -Q '(PID == 1) and (FD == 1)'

Do the same in an alternative way:

# lsfd -Q '(PID == 1) && (FD == 1)'

List all running executables:

# lsfd -Q 'ASSOC == "exe"'

Do the same in an alternative way:

# lsfd -Q 'ASSOC eq "exe"'

Do the same but print only file names:

# lsfd -o NAME -Q 'ASSOC eq "exe"' | sort -u

List deleted files associated to processes:

# lsfd -Q 'DELETED'

List non-regular files:

# lsfd -Q 'TYPE != "REG"'

List block devices:

# lsfd -Q 'DEVTYPE == "blk"'

Do the same with TYPE column:

# lsfd -Q 'TYPE == "BLK"'

List files including "dconf" directory in their names:

# lsfd -Q 'NAME =~ ".\*/dconf/.*"'

List files opened in a QEMU virtual machine:

# lsfd -Q '(COMMAND =~ ".\*qemu.*") and (FD >= 0)'

List timerfd files expired within 0.5 seconds:

# lsfd -Q '(TIMERFD.remaining < 0.5) and (TIMERFD.remaining > 0.0)'

COUNTER EXAMPLES¶

Report the numbers of netlink socket descriptors and unix socket descriptors:

# lsfd --summary=only \


        -C 'netlink sockets':'(NAME =~ "NETLINK:.*")' \


        -C 'unix sockets':'(NAME =~ "UNIX:.*")'
VALUE COUNTER


   57 netlink sockets


 1552 unix sockets

Do the same but print in JSON format:

# lsfd --summary=only --json \


        -C 'netlink sockets':'(NAME =~ "NETLINK:.*")' \


        -C 'unix sockets':'(NAME =~ "UNIX:.*")'
{


   "lsfd-summary": [


      {


         "value": 15,


         "counter": "netlink sockets"


      },{


         "value": 798,


         "counter": "unix sockets"


      }


   ]
}

HISTORY¶

The lsfd command is part of the util-linux package since v2.38.

AUTHORS¶

Masatake YAMATO <yamato@redhat.com>, Karel Zak <kzak@redhat.com>

SEE ALSO¶

bpftool(8) bps(8) lslocks(8) lsof(8) pidof(1) proc(5) scols-filter(5) socket(2) ss(8) stat(2)

REPORTING BUGS¶

For bug reports, use the issue tracker at <https://github.com/util-linux/util-linux/issues>.

AVAILABILITY¶

The lsfd command is part of the util-linux package which can be downloaded from Linux Kernel Archive <https://www.kernel.org/pub/linux/utils/util-linux/>.