Frequently Asked Questions about lsof

**********************************************************************

| The latest release of lsof is always available via anonymous ftp |

| from lsof.itap.purdue.edu. Look in pub/lsof.README for its |

| location. |

**********************************************************************

______________________________________________________________________

This file contains frequently asked questions about lsof and answers

to them.

Vic Abell <[email protected]>

September 27, 2011

______________________________________________________________________

Table of Contents:

1.0 General Concepts

1.1 Lsof -- what is it?

1.2 Where do I get lsof?

1.2.1 Are there mirror sites?

1.2.2 Are lsof executables available?

1.2.3 How do I check the validity of an lsof distribution?

1.2.4 Why can't I get the sum(1) result reported in

README.lsof_<revision>?

1.2.5 Why won't gpg accept the lsof-signing PGP public key?

1.3 Where can I get more lsof documentation?

1.4 How do I report an lsof bug?

1.5 Where can I get the lsof FAQ?

1.5.1 How timely is the on-line FAQ?

1.6 Is there a test suite?

1.7 Is lsof vulnerable to the standard I/O descriptor attack?

1.8 Can I alter lsof's make(1) behavior?

1.9 Is there an lsof license?

1.10 Language locale support

1.10.1 Does lsof support language locales? How do I use the support?

1.10.2 Does lsof support wide characters in language locales?

1.11 Are any files in the lsof distribution copyrighted?

1.12 Are there other lsof-related resources?

1.13 What does the "WARNING: unsupported dialect or version" mean?

2.0 Lsof Ports

2.1 What ports exist?

2.2 What about a new port?

2.2.1 User-contributed Ports

2.3 Why isn't there an AT&T SVR4 port?

2.4 Why isn't there an SGI IRIX port?

2.5 Why does lsof's Configure script report "WARNING: unsupported

dialect or version"?

3.0 Lsof Problems

3.1 Configuration Problems

3.1.1 Why can't Configure determine the UNIX dialect version?

3.2 Compilation Problems

3.2.1 Why does the compiler complain about missing header files?

3.2.2 Why does gcc complain about the contents of header files

distributed by the system's vendor?

3.2.3 Other header file problems

3.3 Why doesn't lsof report full path names?

3.3.1 Why do lsof -r reports show different path names?

3.3.2 Why does lsof report the wrong path names?

3.3.3 Why doesn't lsof report path names for unlinked (rm'd) files?

3.3.4 Why doesn't lsof report the "correct" hard linked file path

name?

3.3.5 When will lsof report path names for deleted files?

3.4 Why is lsof so slow?

3.5 Why doesn't lsof's setgid or setuid permission work?

3.6 Does lsof have security problems?

3.7 Will lsof show remote hosts using files via NFS?

3.8 Why doesn't lsof report locks held on NFS files?

3.8.1 Why does lsof report a one byte lock on byte zero as a full

file lock?

3.9 Why does lsof report different values for open files on the

same file system (the automounter phenomenon)?

3.10 Why don't lsof and netstat output match?

3.10.1 Why can't lsof find accesses to some TCP and UDP ports?

3.11 Why does lsof update the device cache file?

3.12 Why doesn't lsof report state for UDP socket files?

3.13 I am editing a file with vi; why doesn't lsof find the file?

3.14 Why doesn't lsof report TCP/TPI window and queue sizes for my

dialect?

3.14.1 Why doesn't lsof report socket options, socket states, and TCP

flags and values for my dialect?

3.14.2 Why doesn't lsof report the partial listen queue connection

count for my dialect?

3.15 What does "no more information" in the NAME column mean?

3.16 Why doesn't lsof find a process that ps finds?

3.17 Why doesn't -V report a search failure?

3.18 Portmap problems

3.18.1 Why isn't a name displayed for the portmap registration?

3.18.2 How can I display only portmap registrations?

3.18.3 Why doesn't lsof report portmap registrations for some ports?

3.19 Why is `lsof | wc` bigger than my system's open file limit?

3.20 Why doesn't lsof report file offset (position)?

3.20.1 What does lsof report for size when the file doesn't really have

one?

3.21 Problems with path name arguments

3.21.1 How do I ask lsof to search a file system?

3.21.2 Why doesn't lsof find all the open files in a file system?

3.21.3 Why does the lsof exit code report it didn't find open files

when some files were listed?

3.21.4 Why won't lsof find all the open files in a directory?

3.21.5 Why are the +D and +d options so slow?

3.21.6 Why do the +D and +d options produce warning messages?

3.22 Why can't my C compiler find the rpcent structure definition?

3.23 Why doesn't lsof report fully on file "foo" on UNIX dialect

"bar?"

3.24 Why do I get a complaint when I execute lsof that some library

file can't be found?

3.25 Why does lsof complain it can't open files?

3.26 Why does lsof warn "compiled for x ... y; this is z."?

3.27 How can I disable the kernel identity check?

3.28 Why don't ps(1) and lsof agree on the owner of a process?

3.29 Why doesn't lsof find an open socket file whose connection

state is past CLOSE_WAIT?

3.30 Why don't machine.h definitions work when the surrounding

comments are removed?

3.31 What do "can't read inpcb at 0x...", "no protocol control

block", "no PCB, CANTSENDMORE, CANTRCVMORE", etc. mean?

3.32 What do the "unknown file system type" warnings mean?

3.33 Installation

3.33.1 How do I install lsof?

3.33.2 How do I install a common lsof when I have machines that

need differently constructed lsof binaries?

3.34 Why do lsof 4.53 and above reject device cache files built

by earlier lsof revisions?

3.35 What do "like block special" and "like character special" mean

in the NAME column?

3.36 Why does an lsof make fail because of undefined symbols?

3.37 Command Regular Expressions (REs)

3.37.1 What are basic and extended regular expressions?

3.37.2 Why can't I put a slash in a command regular expression?

3.37.3 Why does lsof say my command regular expression wasn't found?

3.38 Why doesn't lsof report on shared memory segments?

3.39 Why does lsof report two instances of itself?

3.40 Why does lsof report '\n' in device cache file error messages?

3.41 Kernel Symbol and Address Problems

3.41.1 What does "lsof: WARNING: name cache hash size length error: 0"

mean?

3.41.2 Why does lsof produce "garbage" output?

3.42 Why does lsof report open files when run as super user that

it doesn't report when run with lesser privileges?

3.43 Test Suite Problems

3.43.1 Errors all tests can report:

3.43.1.1 Why do tests complain "ERROR!!! can't execute ../lsof"?

3.43.1.2 Why do tests complain "ERROR!!! can't find ..." a file?

3.43.1.3 Why do some tests fail to compile?

3.43.1.4 Why do some tests always fail?

3.43.1.5 Why does the test suite say it hasn't been validated on

my dialect?

3.43.1.6 Why do the tests complain they can't stat() or open()

/dev/mem or /dev/kmem?

3.43.2 LTbigf test issues

3.43.2.1 Why does the LTbigf test say that the dialect doesn't

support large files?

3.43.2.2 Why does LTbigf complain about operations on its config.LTbigf*

file?

3.43.2.3 Why does LTbigf warn that lsof doesn't return file offsets?

3.43.3 Why does the LTbasic test complain "ERROR!!! lsof this ..."

and "ERROR!!! lsof that ..."?

3.43.4 LTnfs test issues

3.43.4.1 Why does the LTnfs test complain "couldn't find NFS file ..."?

3.43.5 LTnlink test issues

3.43.5.1 Why does the LTnlink test complain that its test file is on

an NFS file system?

3.43.5.2 Why does LTnlink delay and report "waiting for link count

update: ..."?

3.43.5.3 Why does LTnlink fail because of an unlink error?

3.43.6 LTdnlc test issues

3.43.6.1 Why won't the LTdnlc test run?

3.43.6.2 What does the LTdnlc test mean by "... <path> found: 100.00%"?

3.43.6.3 Why does the DNLC test fail?

3.43.7 Why hasn't the test suite been qualified for 64 bit HP-UX

11 when lsof is compiled with gcc?

3.43.8 LTszoff test issues

3.43.8.1 Why does LTszoff warn that lsof doesn't return file offsets?

3.43.9 LTlock test issues

3.44 File descriptor list (the ``-d'' option) problems

3.44.1 Why does lsof reject a ``-d'' FD list?

3.44.2 Why are file descriptors other than those in my FD list

reported?

3.45 How can I supply device numbers for inaccessible NFS file

systems?

3.46 Why won't lsof find open files on over-mounted file systems?

3.47 What can be done when lsof reports no more space?

3.48 What if the lsof build encounters ar and ld problems?

4.0 AIX Problems

4.1 What is the Stale Segment ID bug and why is -X needed?

4.1.1 Stale Segment ID APAR

4.2 Gcc Work-around for AIX 4.1x

4.3 Gcc and AIX 4.2

4.4 Why won't lsof's Configure allow the use of gcc for AIX

below 4.1?

4.5 What is an AIX SMT file type?

4.6 Why does AIX lsof start so slowly?

4.7 Why does exec complain it can't find libc.a[shr.o]?

4.8 What does lsof mean when it says, "TCP no PCB, CANTSENDMORE,

CANTRCVMORE" in a socket file's NAME column?

4.9 When the -X option is used on AIX 4.3.3, why does lsof disable

it, saying "WARNING: user struct mismatch; -X option disabled?"

4.10 Why doesn't the -X option work on my AIX 5L or 5.[123] system?

4.11 Why doesn't /usr/bin/oslevel report the correct AIX version?

4.11.1 Why doesn't /usr/bin/oslevel report the correct AIX version

on AIX 5.1?

4.12 Why does lsof for AIX 5.1 or above Power architecture

complain about kernel bit size?

4.13 What can't gcc be used to compile lsof on the ia64 architecture

for AIX 5 and above?

4.14 Why does lsof get a segmentation fault when compiled with gcc

for a 64 bit Power architecture AIX 5.1 kernel?

4.15 Why does lsof ignore AFS on my AIX system?

4.16 Why does lsof report "system paging space is low" and exit?

4.17 Why does lsof have compilation and execution problems on AIX

5.3 above maintenance level 1?

5.0 Apple Darwin Problems

5.1 What do /dev/kmem-based and libproc-based mean?

5.2 /dev/kmem-based Apple Darwin Questions

5.2.1 Why does Configure ask for a path to the Darwin XNU kernel

header files?

5.2.1.1 Why does Configure complain that Darwin XNU kernel header

files are missing?

5.2.2 Why doesn't Apple Darwin lsof report text file information?

5.2.3 Why doesn't Apple Darwin lsof support IPv6?

5.2.4 Why does lsof complain about a mismatch between the release

for which lsof was compiled and the booted Mac OS X release?

5.2.5 Why does lsof for Apple Darwin 8 and higher report

"stat(...): ..." in the NAME column?

5.2.6 What are the limitations of Apple Darwin lsof link count

reporting?

5.3 Libproc-based Apple Darwin Questions

6.0 BSD/OS BSDI Problems

6.0.5 Statement of deprecation

7.0 DEC OSF/1, Digital UNIX, and Tru64 UNIX Problems

7.1 Why does lsof complain about non-existent /dev/fd entries?

7.2 Why does the Digital UNIX V3.2 ld complain about Ots* symbols?

7.3 Why can't lsof locate named pipes (FIFOs) under V3.2?

7.4 Why does lsof use the wrong configuration header files?

For example, why can't the lsof compilation find cpus.h?

7.5 Why does lsof indicate incomplete paths with " -- " for Tru64

UNIX 5.1 files?

7.6 Why doesn't lsof report link count, node number, and size

for some Tru64 5.x CFS files?

7.7 Why does lsof say it can't read the kernel name list or

proc table on Digital UNIX 4.x or Tru64 UNIX?

8.0 FreeBSD Problems

8.1 Why doesn't lsof report on open kernfs files?

8.2 Why doesn't lsof work on my FreeBSD system?

8.3 Why doesn't lsof work on the RELEASE version of CURRENT?

8.4 Why can't kvm_open() can't find some file?

8.5 FreeBSD ZFS Problems

8.5.1 Why does FreeBSD lsof report "WARNING: no ZFS support has been

8.6 Why can't Configure create lsof_owner.h for FreeBSD 6 and above?

8.6.1 Why are there lockf structure compiler errors for FreeBSD 6.0

and higher lsof?

8.6.2 Why don't /usr/src/sys/sys/lockf.h and /usr/include/sys/lockf.h

match?

9.0 HP-UX Problems

9.1 What do /dev/kmem-based and PSTAT-based mean?

9.2 /dev/kmem-based HP-UX lsof Questions

9.2.1 Why doesn't a /dev/kmem-based HP-UX lsof compilation use -O?

9.2.2 Why doesn't the /dev/kmem-based CCITT support work under 10.x?

9.2.3 Why can't /dev/kmem-based lsof be compiled with `cc -Aa` or

`gcc -ansi` under HP-UX 10.x?

9.2.4 Why does /dev/kmem-based lsof complain about no C compiler?

9.2.5 Why does Configure complain about q4 for /dev/kmem-based lsof

for HP-UX 11?

9.2.6 When compiling /dev/kmem-based lsof for HP-UX 11 what do the

"aCC runtime: ERROR..." messages mean?

9.2.7 Why doesn't /dev/kmem-based lsof for HP-UX 11 report VxFS file

link counts, node numbers, and sizes correctly?

9.2.8 Why can't /dev/kmem-based lsof be built with gcc for 64 bit

HP-UX 11?

9.2.8.1 How can I acquire a gcc for building lsof for 64 bit HP-UX 11?

9.2.9 Why does /dev/kmem-based lsof for HP-UX 11 report "unknown file

system type" for VxFS files?

9.2.10 Why does the ANSI-C compiler complain about comments in HP-UX

11 header files?

9.2.11 Why does dnode1.c cause the HP-UX 11 compiler to complain that

<sys/fs/vx_inode.h> is missing or incorrect?

9.3 PSTAT-based HP-UX lsof Questions

9.3.1 Why does PSTAT-based lsof complain about pst_static and

other PSTAT structures?

9.3.2 Why does PSTAT-based lsof complain it can't read pst_*

structures?

9.3.3 Why does PSTAT-based lsof rebuild the device cache file

after each reboot?

9.3.4 Why doesn't PSTAT-based lsof report TCP addresses for

telnetd's open socket files?

9.3.5 Why does PSTAT-based lsof cause an HP-UX 11.11 kernel panic?

9.3.6 Why doesn't PSTAT-based lsof report a CWD that is on a loopback

(LOFS) file system?

9.3.7 Why do some swinstall packages for PSTAT-based HP-UX 11.11

packages complain about setgid and setuid bits?

9.3.8 Why won't the bundled C compiler build PSTAT-based lsof for

PA-RISC HP-UX 11.23?

9.3.9 Why won't gcc build PSTAT-based lsof for PA-RISC HP-UX 11.23?

9.3.10 Why does PSTAT-based lsof complain, "FATAL: pst_stream_size

should be: 672; is 72" on HP-UX 11.11 and above?

9.4 Why won't the HP-UX depot install?

10.0 Linux Problems

10.1 What do /dev/kmem-based and /proc-based lsof mean?

10.2 /proc-based Linux lsof Questions

10.2.1 Why doesn't /proc-based lsof report file offsets (positions)?

10.2.2 Why does /proc-based lsof report "can't identify protocol" for

some socket files?

10.2.3 Why does /proc-based lsof warn about unsupported formats?

10.2.4 Why does /proc-based lsof report "(deleted)" after a path name?

10.2.5 Why doesn't /proc-based lsof report full open file information

for all processes?

10.2.6 Why won't Customize offer to change HASDCACHE or WARNDEVACCESS

for /proc-based lsof?

10.2.7 /proc-based lsof Linux NFS questions

10.2.7.1 Why can't lsof find files on an accessible NFS file system?

10.2.7.2 Why can't lsof find files on an inaccessible NFS file system?

10.2.8 Why doesn't /proc-based Linux lsof report socket options and

values, socket state flags, and TCP options and values?

10.2.9 Does /proc-based Linux lsof use a device cache?

10.2.10 Why doesn't /proc-based Linux lsof report any or all file structure

values for its +fcfgGn option?

10.3 Special Linux file types

10.3.1 Why is ``DEL'' reported as a Linux file type?

10.3.2 Why is ``unknown'' reported as a Linux file type?

10.4 Linux ``mem'' Entry Problems

10.4.1 What do ``path dev=xxx'' and ``path inode=yyy'' mean in the

NAME column of Linux ``mem'' file types?

10.4.2 Why is neither link count nor size reported for some Linux

``DEL'' and ``mem'' file types?

10.5 Special Linux NAME column messages

10.5.1 What does ``(stat: xxx)'' mean in the NAME column of Linux

files?

10.5.2 What does ``(readlink: xxx)'' mean in the NAME column of

Linux files?

10.6 Why is ``NOFD'' reported as a Linux file type?

10.7 Why does Linux lsof report a NAME column value that begins with

``/proc''?

10.8 Linux /proc/net/tcp* and /proc/net/udp* issues

10.8.1 Why use the Linux -X option?

10.8.2 Why does lsof say ``-i is useless when -X is specified''?

10.8.3 Why does lsof say ``can't identify protocol (-X specified)''?

11.0 NetBSD Problems

11.1 Why doesn't lsof report on open kernfs files?

11.2 Why doesn't lsof report on open files on: file descriptor

file systems; /proc file systems; 9660 (CD-ROM) file systems;

MS-DOS (floppy disk) file systems; or kernel file systems?

11.3 Why does lsof produce confusing results for nullfs file

systems?

11.4 NetBSD header file problems

11.4.1 Why can't the compiler find some NetBSD header files?

11.4.2 Why does NetBSD lsof produce incorrect output?

11.5 Why isn't lsof feature xxx enabled for NetBSD?

12.0 NEXTSTEP and OPENSTEP Problems

12.1 Why can't lsof report on 3.1 lockf() or fcntl(F_SETLK)

locks?

12.2 Why doesn't lsof compile for NEXTSTEP with AFS?

13.0 OpenBSD Problems

13.1 Why doesn't lsof support kernfs on my OpenBSD system?

13.2 Will lsof work on OpenBSD on non-x86-based architectures?

13.3 <sys/pipe.h> problems

13.3.1 Why does the compiler claim nbpg isn't defined?

13.3.2 What value should I assign to nbpg?

13.4 Why doesn't lsof report on open MS-DOS file system (floppy

disk) files?

13.5 Why isn't lsof feature xxx enabled for OpenBSD?

14.0 Output problems

14.1 Why do the lsof column sizes change?

14.2 Why does the offset have ``0t' and ``0x'' prefixes?

14.3 What are the values printed in the FILE_FLAG column

and why is 0x<value> sometimes included?

14.3.1 Why doesn't lsof display FILE_FLAG values for my dialect?

14.4 Network Addresses

14.4.1 Why does lsof's -n option cause IPv4 addresses, mapped to

IPv6, to be displayed in IPv6 notation?

14.5 Why does lsof output \x, ^x, or \xnn for characters

sometimes?

14.5.1 Why is space considered a non-printable character in command

names?

14.6 Why doesn't lsof print all the characters of a command name?

14.7 Why does lsof reject some -c command names, saying their lengths

are "> what system provides (nn)"?

14.8 Why does lsof sometimes print TYPE numbers instead of names?

14.9 Marker line format problems

14.9.1 Why won't lsof accept a marker line format?

14.9.2 Why does lsof reject the NL (%n) marker line format?

14.10 How are protocol state name exclusion and inclusion used?

14.10.1 Why doesn't my dialect support state name exclusion and inclusion?

15.0 Pyramid Version Problems

15.0.5 Statement of deprecation

16.0 SCO Problems

16.1 SCO OpenServer Problems

16.1.1 How can I avoid segmentation faults when compiling lsof?

16.1.2 Where is libsocket.a?

16.1.3 Why do I get "warning C4200" messages when I compile lsof?

16.2 SCO|Caldera UnixWare Problems

16.2.1 Why doesn't lsof compile on my UnixWare 7.1.1 or above

system?

16.2.2 Why does lsof complain about node_self() on my UnixWare

7.1.1 or above system?

16.2.3 Why does UnixWare 7.1.1 or above complain about -lcluster,

node_self(), or libcluster.so?

16.2.4 Why does UnixWare 7.1.1 or above lsof complain it can't

read the kernel name list?

16.2.5 Why doesn't lsof report link count, node number, and size

for some UnixWare 7.1.1 or above CFS files?

16.2.6 Why doesn't lsof report open files on all UnixWare 7.1.1

NonStop Cluster (NSC) nodes?

16.2.7 Why doesn't lsof report the UnixWare 7.1.1 NonStop Cluster

(NSC) node a process is using?

16.2.8 Why does the compiler complain about missing UnixWare 2.1[.x]

header files?

17.0 Sun Problems

17.0.5 Statement of deprecation

17.1 My Sun gcc-compiled lsof doesn't work -- why?

17.2 How can I make lsof compile with gcc under Solaris 2.[456],

2.5.1, 7, 8 or 9?

17.3 Why does Solaris Sun C complain about system header files?

17.4 Why doesn't lsof work under my Solaris 2.4 system?

17.5 Where are the Solaris header files?

17.6 Where is the Solaris /usr/src/uts/<architecture>/sys/machparam.h?

17.7 Why does Solaris lsof say ``can't read proc table''?

17.8 Why does Solaris lsof complain about a bad cached clone device?

17.9 Why doesn't Solaris make generate .o files?

17.10 Why does lsof report some Solaris 2.3 and 2.4 lock types as `N'?

17.11 Why does lsof Configure say "WARNING: no cc in ..."?

17.12 Solaris 7, 8 and 9 Problems

17.12.1 Why does lsof say the compiler isn't adequate for Solaris

7, 8 or 9?

17.12.2 Why does Solaris 7, 8 or 9 lsof say "FATAL: lsof was compiled

for..."?

17.12.3 How do I build lsof for a 64 bit Solaris kernel under a 32

bit Solaris kernel?

17.12.4 How do I install lsof for Solaris 7, 8 or 9?

17.12.5 Why does my Solaris 7, 8 or 9 system say it cannot execute

lsof?

17.12.6 What gcc will produce 64 bit Solaris 7, 8 and 9 executables?

17.12.7 Why does lsof on my Solaris 7, 8 or 9 system say, "can't

read namelist from /dev/ksyms?"

17.13 Solaris and COMMON

17.13.1 What does COMMON mean in the NAME column for a Solaris VCHR

file?

17.13.2 Why does a COMMON Solaris VCHR file sometimes seem to have an

incorrect minor device number?

17.14 Why don't lsof and Solaris pfiles reports always match?

17.15 Why does lsof say, "kvm_open(namelist=default, core=default):

Permission denied?"

17.16 Why is lsof slow on my busy Solaris UFS file system?

17.17 Why is lsof so slow on my Solaris 8 or 9 system?

17.18 Solaris and VxFS

17.18.1 Why doesn't lsof support VxFS 3.4 on Solaris 2.6, and above?

17.18.2 Why does lsof report "vx_inode: vxfsu_get_ioffsets error"

for open Solaris 2.6 and above VxFS 3.4 and above files?

17.18.3 Why does Solaris Configure claim there is no VxFS library?

17.18.4 Why doesn't Solaris lsof report VxFS path name components?

17.18.5 Why does Solaris 10 lsof report scrambled VxFS paths?

17.19 Large file problems

17.19.1 Why does lsof complain it can't stat(2) a Solaris 2.5.1

large file?

17.20 Why does lsof get a segmentation fault on 64 bit Solaris

8 using NIS+?

17.21 Will lsof crash the Solaris kernel?

17.22 Why does lsof on Solaris 7, 8, or 9 report a kvm_open()

failure?

17.23 Solaris and SAM-FS

17.23.1 Why does Solaris lsof report "(limited SAM-FS info)"?

17.23.2 Why can't lsof locate named SAM-FS files?

17.24 Lsof and Solaris 10 zones

17.24.1 How can I make lsof list the Solaris zone?

17.24.2 Why doesn't lsof work in a Solaris 10 zone?

17.24.3 Why does lsof complain it can't stat() Solaris 10 zone file

systems?

17.25 Solaris 10 problems

17.25.1 Why does Solaris 10 lsof sometimes report the wrong path name?

17.25.2 Why does Solaris 10 lsof sometimes report only the mounted-on

directory and device?

17.25.3 What does "(deleted)" mean in the NAME column of a Solaris 10

open file?

17.25.4 What does "(?)" mean in the NAME column of a Solaris 10 open

file?

17.26 Solaris contract file problems

17.26.1 Why doesn't lsof report size, link count and node number for

Solaris 10 contract files?

17.26.2 Why can't lsof locate a Solaris 10 contract file by path name?

17.27 Solaris 10 ZFS probblems

17.27.1 Why does Configure ask for the location of ZFS header files?

17.27.2 Why do -h and -v output warn about possibly inaccurate ZFS

structure definitions?

17.27.3 Why don't the Open Solaris ZFS header files provide correct

ZFS kernel structure definitions?

17.28 Problems with Solaris 9 and above

17.28.1 Why does the compiler complain about lgrp_root on Solaris 9

and above?

18.0 Lsof Features

18.1 Why doesn't lsof doesn't report on /proc entries on my

system?

18.2 How do I disable the device cache file feature or alter

it's behavior?

18.2.1 What's the risk with a perverted device cache file?

18.2.2 How do I put the full host name in a personal device cache file

path?

18.2.3 How do I put the personal device cache file in /tmp?

18.3 Why doesn't lsof know about AFS files on my favorite dialect?

18.3.1 Why doesn't lsof report node numbers for all AFS volume files,

or how do I reveal dynamic module addresses to lsof?

______________________________________________________________________

1.0 General Concepts

1.1 Lsof -- what is it?

Lsof is a UNIX-specific tool. Its name stands for LiSt

Open Files, and it does just that. It lists information

about files that are open by the processes running on a

UNIX system.

See the lsof man page, the 00DIST file, the 00QUICKSTART

file, and the 00README file of the lsof distribution for

more information.

1.2 Where do I get lsof?

Lsof is available via anonymous ftp from lsof.itap.purdue.edu.

Look in the pub/tools/unix/lsof sub-directory.

ftp://lsof.itap.purdue.edu/pub/tools/unix/lsof

Bzip2'd, compressed and gzip'd tar files with GPG certificates

are available.

1.2.1 Are there mirror sites?

On April 28, 2009 these sites appeared to have the lastest

lsof revision:

ftp://ftp.fu-berlin.de/pub/unix/tools/lsof

ftp://sunsite.ualberta.ca/pub/Mirror/lsof

1.2.2 Are lsof executables available?

Some lsof executables are available in the subdirectory

tree pub/tools/unix/lsof/binaries These are neither guaranteed

to be current nor cover every dialect and machine architecture.

I don't recommend you use pre-compiled lsof binaries; I

recommend you obtain the sources and build your own binary.

Even if you're a Sun user without a Sun C compiler, you

can use gcc to compile lsof.

If you must use a binary file, please be conscious of the

security and configuration implications in using an executable

of unknown or different origin. The lsof binaries are

accompanied by GPG certificates. Please use them!

Three additional cautions apply to executables:

1. Don't try to use an lsof executable, compiled for one

version of a UNIX dialect, on another. Patches can

make the dialect version different.

2. If you want to use an lsof binary on multiple systems,

they must be running the same dialect OS version and

have the same patches and feature support.

1.2.3 How do I check the validity of an lsof distribution?

There are two ways to check the validity of an lsof

distribution:

1. Follow the instructions in the CHECKSUMS_<revision>

file found with the lsof distribution.

Checking with GPG is the best method.

2. Follow the instructions in the "Security" section of the

README.lsof_<revision> file found inside the lsof

distribution.

Again, checking with GPG is the best method.

1.2.4 Why can't I get the sum(1) result reported in

README.lsof_<revision>?

The "Security" section of the README.lsof_<revision> file found

inside the lsof distribution gives md5, sum, and GPG certificate

information.

The simplest, the sum(1) signature, seems to be the trickiest.

That's because there are different sum(1) methods, BSD systems

usually have cksum(1) instead of sum(1), and different systems

compute the block size value differently.

First, the lsof sum results are computed with the old,

"alternate" algorithm. On newer systems, you can use sum's

"-r" option to get that computation result.

Second, on BSD systems you usually must use cksum(1) instead

of sum(1), because they have no sum(1). To tell cksum(1)

to use the old, "alternate" algorithm, use its "-o1" option.

Third, the second value that sum reports, the block count, may

be computed differently on different systems -- usually block

size is considered to be 512 or 1,024. The lsof block counts

were computed on a system with a sum(1) option that considers

block size to be 512. The BSD system cksum(1) -o1 option

considers block size to be 1,024. If your sum(1) or cksum(1)

doesn't report a block count that matches the sum(1) signature

given in README.lsof_<revision>, check its man page to see what

block size it uses, then adjust its reported block count

appropriately.

1.2.5 Why won't gpg accept the lsof-signing PGP public key?

An older PGP key that once signed lsof distributions is

included in lsof revisions prior to 4.70. The PGP key is

indeed my key, but is incompatible with GPG. It was created

about ten years ago and is still acceptable to PGP versions

2.6.2 through 6.5.2.

Lsof revisions 4.70 and above are signed with a copy of my PGP

key that has been made acceptable for use with GPG by importing

it under GPG's "--allow-non-selfsigned-uid" option.

You can find my GPG compatible key in lsof revisions 4.70 and

above and at:

ftp://lsof.itap.purdue.edu/pub/Victor_A_Abell.gpg

If you have an older lsof revision with my PGP key, there are

two possible ways to use it:

* Use it with a PGP version from 2.6.2 through 6.5.2.

* Use GPG's "--allow-non-selfsigned-uid" option when you

import my PGP key into your GPG key ring.

$ gpg --allow-non-selfsigned-uid --import Victor_A_Abell.pgp

1.3 Where can I get more lsof documentation?

A significant set of documentation may be found in the lsof

distribution (See "Where can I get lsof?). There is a

manual page, copious documentation in files whose names

begin with 00, and a copy of this FAQ in the file 00FAQ

(perhaps slightly less recent than this file if you're

reading it via a web browser.)

Two URLs provide some documentation that appears in the

lsof distribution:

FAQ: ftp://lsof.itap.purdue.edu/pub/tools/unix/lsof/FAQ

man page: ftp://lsof.itap.purdue.edu/pub/tools/unix/lsof/lsof_man

1.4 How do I report an lsof bug?

If you believe you have discovered a bug in lsof, you can

report it via e-mail to <[email protected]>. Do NOT report lsof

bugs to the UNIX dialect vendor. Make sure "lsof" appears in

the "Subject:" line so my e-mail filter won't classify your

letter as Spam.

Before you send me a bug report, please read the "Bug Reports"

section of the 00README file of the lsof distribution. It

lists the steps you should take before and when reporting a

suspected bug.

1.5 Where can I get the lsof FAQ?

This lsof FAQ is available in the file 00FAQ in the lsof

distribution and at the URL:

ftp://lsof.itap.purdue.edu/pub/tools/unix/lsof/FAQ

1.5.1 How timely is the on-line FAQ?

The on-line FAQ is sometimes too timely. :-)

I update it as soon as new information is available. That may

include information about support that won't appear in the lsof

source distribution until the next revision. If you encounter

something like that, please send me e-mail at <[email protected]>. I

may be able to point you at a pre-release distribution that contains

the support of interest. Make sure "lsof" appears in the "Subject:"

line so my e-mail filter won't classify your letter as Spam.

1.6 Is there a test suite?

Yes, as of lsof revision 4.63 there's an automated lsof

test suite in the tests/ sub-directory of the lsof top-level

directory.

More information on using the test suite, what it does,

how to use it and how to configure it may be found in the

00TEST file of the lsof distribution. That file also

explains where the test suite has been tested.

Frequently asked questions about the test suite will be

asked and answered here in the FAQ. (See "Test Suite

Problems.")

After lsof has been configured with the Configure script,

lsof can be made and tested with:

$ make

$ cd tests

$ make

Under normal conditions -- i.e., unless the lsof tree has

been cleaned or purged severely -- all tests or individual

tests may be run by:

$ cd test

$ make

or

$ <run a single test> (See 00TEST.)

1.7 Is lsof vulnerable to the standard I/O descriptor attack?

Lsof revisions 4.63 and above are not vulnerable.

Lsof revisions 4.62 and below are vulnerable, but no damage

scenarios have so far been demonstrated.

The standard I/O descriptor attack is a local programmed

assault on setuid and setgid programs that tricks them into

opening a sensitive file with write access on a standard

descriptor, usually stderr (2), and writing error messages

to stderr. If the attacker can control the content of the

error message, the attacker may gain elevated privileges.

The attack was first described in Pine Internet Advisory

PINE-CERT-20020401, available at:

http://www.pine.nl/advisories/pine-cert-20020401.txt

If you are using an lsof revision below 4.63, you should

remove any setuid or setgid permissions you might have

given its executable. Then you should upgrade to lsof

revision 4.63.

1.8 Can I alter lsof's make(1) behavior?

Yes. There are at least two ways to do that.

You can put replacements for lsof Makefile strings in your

environment. If you specify the -e make option, make will

give environment variable values precedence over strings

from the Makefile. For example, to change the compiler

string CC from the environment, you might do this with the

Bourne shell:

$ CC=foobar; export CC

$ make -e

You can also replace lsof Makefile strings in the make

command invocation. Here's the previous example done that

way:

$ make CC=foobar

Changing the CFGF, CFGL, and DEBUG strings used in lsof

Makefiles, either from the environment or from the make

invocation, can significantly alter lsof make(1) behavior.

I commonly use DEBUG to change the -O option to -g so I

can build an lsof executable for debugging -- e.g.,

$ make DEBUG=-g

(Look for DEBUG in this FAQ for other examples of its use.)

Consult the Makefiles to see what CFGL, CFGL, and other

lsof Makefile strings contain, and to see what influence

their alteration might have on lsof make(1) behavior.

1.9 Is there an lsof license?

No.

The only restriction on the use or redistribution of lsof

is contained in this copyright statement, found in every

lsof source file. (The copyright year in or format of the

notice may vary slightly.)

/*

* Copyright 2002 Purdue Research Foundation, West Lafayette,

* Indiana 47907. All rights reserved.

*

* Written by Victor A. Abell

*

* This software is not subject to any license of the American

* Telephone and Telegraph Company or the Regents of the

* University of California.

*

* Permission is granted to anyone to use this software for

* any purpose on any computer system, and to alter it and

* redistribute it freely, subject to the following

* restrictions:

*

* 1. Neither the authors nor Purdue University are responsible

* for any consequences of the use of this software.

*

* 2. The origin of this software must not be misrepresented,

* either by explicit claim or by omission. Credit to the

* authors and Purdue University must appear in documentation

* and sources.

*

* 3. Altered versions must be plainly marked as such, and must

* not be misrepresented as being the original software.

*

* 4. This notice may not be removed or altered.

*/

1.10 Language locale support

1.10.1 Does lsof support language locales? How do I use the support?

Most UNIX dialect versions of lsof support 8 bit language

locale characters -- e.g., the ability to print 8 bit

characters that have accents and other marks over them.

See the answer to the "Does lsof support wide characters in

language locales?" question for information on when lsof's

language locale support covers characters wider than 8 bits.

To see if lsof supports language locales for your dialect, look

in the dialect's machine.h header file for the HASSETLOCALE

definition. If it is present and not disabled, then lsof has

language locale support for the dialect.

To enable lsof's language locale support, you must specify in a

locale environment variable (e.g., LANG) a language locale

known to your system that supports the printing of marked

characters -- e.g, en_US. (On some dialects locale(1) may be

used to list the known language locales.)

Note that LANG=C and LANG=POSIX are NOT language locales that

support the printing of marked characters.

If the language locale doesn't support the printing of marked

characters, lsof's OUTPUT of them follows the rules for

non-printable characters described in the OUTPUT section of

lsof(8).

Consult your dialect's setlocale(3) man page for the names of

environment variables other than LANG -- e.g., LC_ALL,

LC_TYPE, etc. -- which may be used to define language locales.

1.10.2 Does lsof support wide characters in language locales?

When lsof's language locale support is enabled with the

HASSETLOCALE definition, for selected dialects lsof will also

print wide characters (e.g., from UTF-8) when iswprint(3)

reports them to be printable.

Wide character support is available when HASWIDECHAR is defined

in a dialect's machine.h header file. As of this writing on

July 22, 2004, the following dialect versions have wide character

support:

AIX >= 4.3.2

Apple Darwin >= 7.3.0

FreeBSD >= 5.2

HP-UX >= 11.00

/proc-based Linux

NetBSD >= 1.6

SCO OpenServer >= 5.0.6

Solaris >= 2.6

Tru64 UNIX 5.1

1.11 Are any files in the lsof distribution copyrighted?

Yes. Most files carry the copyright of the Purdue Research

Foundation and may be redistributed under the terms that

accompany the copyright notice. Those terms may also be found

in the answer to the question, "Is there an lsof license?")

A few files carry other copyright notices. Some are BSD

notices and they explain the terms under which they are

included in the lsof distribution.

Those that carry vendor copyright notices have been reproduced

in their original or modified forms with permission from the

copyright owners. That permission is indicated in the README

files that accompany the files.

1.12 Are there other lsof-related resources?

There are other resources available, connected to lsof. Among

them are FreeBSD and Linux packages whose products use lsof and

two particularly interesting resources.

The two interesting resources are a Gnome Tool Kit (GTK) GUI

for lsof and a Perl wrapper module.

The GTK GUI is called Glsof and was developed by Gnele. It can

be found at:

http://www.sourceforge.net

The Perl wrapper module by Marc Beyer can be found at:

http://search.cpan.org/dist/Unix-Lsof/

1.13 What does the "WARNING: unsupported dialect or version" mean?

The lsof configure script issues that message for UNIX dialects

or their versions where I have been unable to test the current

revision of lsof. The message doesn't mean that lsof won't

work, just that I have no direct evidence that it will.

If the COnfigure script succeeds, except for the warning, try

compiling) lsof. If that succeeds, try the lsof test suite.

2.0 Lsof Ports

2.1 What ports exist?

The pub/lsof.README file carries the latest port information:

AIX 5.[23] and 5.3

FreeBSD 4.9 and 6.4 for x86-based systems

FreeBSD 8.[02] for AMD64-based systems

Linux 2.1.72 and above for x86-based systems

Solaris 9, 10 and 11

In the above list the only UNIX dialects present are ones for

which I test the current lsof revision. Lsof may still support

unlisted dialect versions -- e.g., HP-UX 10.20, Solaris 7, etc.

-- but I don't have access to systems where I could test lsof

on them, so I can't claim lsof works on them. If your dialect

isn't in the list, you should try building lsof on it anyway.

Lsof version 4 predecessors, versions 2 and 3, may support older

version of some dialects. Contact me via e-mail at <[email protected]>

if you're interested in their distributions. Make sure "lsof"

appears in the "Subject:" line so my e-mail filter won't classify

your letter as Spam.

2.2 What about a new port?

The 00PORTING file in the distribution gives hints on doing

a port. I will consider doing a port in exchange for

permanent access to a test host. I require permanent access

so I can test new lsof revisions, because I will not offer

distributions of dialect ports I cannot upgrade and test.

2.2.1 User-contributed Ports

Sometimes I receive contributions of ports of lsof to

systems where I can't test future revisions of lsof. Hence,

I don't incorporate these contributions into my lsof

distribution.

However, I do make descriptions of these contributions

available. You can find them in the 00INDEX and README

files at:

ftp://lsof.itap.purdue.edu/pub/tools/unix/lsof/contrib

Consult the 00INDEX file in the contrib/ directory for a

list of the available contributions and consult README

there for information on how to obtain them.

2.3 Why isn't there an AT&T SVR4 port?

I haven't produced an AT&T SVR4 port because I haven't seen

a UNIX dialect that is strictly limited to the AT&T System

V, Release 4 source code. Every one I have seen is a

derivative with vendor additions.

The vendor additions are significant to lsof because they

affect the internal kernel structures with which lsof does

business. While some vendor derivatives of SVR4 are similar,

each one I have encounted so far has been different enough

from its siblings to require special source code.

If you're interested in an SVR4 version of lsof, here are

some existing ports you might consider:

DC/OSx (This obsolete port is only available upon

special request.)

Reliant UNIX (This obsolete port is only available

upon special request.)