4

I was going through the questions of this site. In this particular question, I see the command lsof being used to list the files that are open for a particular user. I ran the below command in my terminal. 

lsof -a -u root -d txt

I am seeing a long output which are completely irrelevant (at least to me). I am finding it hard to understand the output produced. This is 

mapping-d 3992 root txt REG 8,5 29728 7169187 /usr/libexec/mapping-daemon clock-app 4005 root txt REG 8,5 88048 7169216 /usr/libexec/clock-applet mixer_app 4007 root txt REG 8,5 53484 7169197 /usr/libexec/mixer_applet2 gnome-scr 4078 root txt REG 8,5 168628 1337742 /usr/bin/gnome-screensaver notificat 4081 root txt REG 8,5 34732 1324168 /usr/libexec/notification-daemon gnome-ter 4219 root txt REG 8,5 309400 1318348 /usr/bin/gnome-terminal gnome-pty 4221 root txt REG 8,5 12384 1899888 /usr/lib/vte/gnome-pty-helper bash 4222 root txt REG 8,5 735932 196459 /bin/bash firefox 15551 root txt REG 8,5 121288 2424613 /usr/lib/firefox/firefox npviewer. 15790 root txt REG 8,5 174364 1996912 /usr/lib/nspluginwrapper/npviewer.bin bash 15908 root txt REG 8,5 735932 196459 /bin/bash lsof 16014 root txt REG 8,5 129820 1323233 /usr/sbin/lsof lsof 16015 root txt REG 8,5 129820 1323233 /usr/sbin/lsof

I was expecting, if I had opened a txt file as the root user, only that file's information would be displayed, if I run the lsof command. Can someone please help me in understanding what this command actually produces as the output?

Improve this question

2 Answers 2

Reset to default
3

The output is organized into columns. If you want to store this output in a file so that you can review it later simply do this:

$ lsof -a -u root -d txt > somefile.txt

The columns are right along the top.

COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME

Description of columns

The columns are as follows:

COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME mapping-d 3992 root txt REG 8,5 29728 7169187 /usr/libexec/mapping-daemon clock-app 4005 root txt REG 8,5 88048 7169216 /usr/libexec/clock-applet mixer_app 4007 root txt REG 8,5 53484 7169197 /usr/libexec/mixer_applet2

  • COMMAND - this is the name of the executable that is using a file.

  • PID - Process ID, this is the process ID of the executable. You'd see these in the output of the ps command as well.

  • USER - This is the userid that the process is owned by.

  • FD - File Descriptor. You specified that you only wanted text file descriptors (-d txt) so you should only see txt in this column. From the man page of lsof, " txt program text (code and data);"

  • TYPE - This denotes the type of node associated with the file. Again consult the man page of lsof. There are a lot of different types of nodes. Here we're primarily dealing with regular files, so you'll see the keyword REG.

  • DEVICE - This column contains device numbers. These are the corresponding devices that are being used for the particular file, from the systems /dev directory.

  • SIZE/OFF - size of the file or the file offset in bytes.

  • NODE - Consult the man page of lsof, in general it's either the node number of a local file, or inode number of an NFS file in the server host, but can be other values as well.

  • NAME - name of file or name of the mount point and file system on which the file resides.

Improve this answer
1

lsof lists all files that are accessed by a program one way or another. The fourth column (FD) describes the way in which the program is accessing the file. Here are some common cases (there are others):

  • A number: the file is opened by the process, and the number is the file descriptor. Letters after the file name indicate the opening mode (e.g. r for read-only, w for write-only, u for both).
  • cwd: the file is the process's current working directory.
  • txt: the file is the process's executable.
  • mem: the file is mapped to the process's virtual memory space.

The descriptor type txt has nothing to do with “text files” in the sense of containing human-readable text or of having a name ending with .txt. Here “text” is an odd bit of terminology refering to executable code, as in the text segment of an executable file which is the section that contain the code. This strange name comes from a now-defunct programming community which predates Unix (General Electric, whose other naming legacy in the Unix world is the “GECOS field”).

Thus what you're seeing is the main executable of each process.

Improve this answer

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.