-
Notifications
You must be signed in to change notification settings - Fork 100
/
00FAQ
7781 lines (6008 loc) · 297 KB
/
00FAQ
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
Frequently Asked Questions about lsof
**********************************************************************
| The latest release of lsof is always available via anonymous ftp |
| from lsof.itap.purdue.edu. Look in pub/lsof.README for its |
| location. |
**********************************************************************
______________________________________________________________________
This file contains frequently asked questions about lsof and answers
to them.
Vic Abell <abe@purdue.edu>
October 13, 2014
______________________________________________________________________
Table of Contents:
1.0 General Concepts
1.1 Lsof -- what is it?
1.2 Where do I get lsof?
1.2.1 Are there mirror sites?
1.2.2 Are lsof executables available?
1.2.3 How do I check the validity of an lsof distribution?
1.2.4 Why can't I get the sum(1) result reported in
README.lsof_<revision>?
1.2.5 Why won't gpg accept the lsof-signing PGP public key?
1.3 Where can I get more lsof documentation?
1.4 How do I report an lsof bug?
1.5 Where can I get the lsof FAQ?
1.5.1 How timely is the on-line FAQ?
1.6 Is there a test suite?
1.7 Is lsof vulnerable to the standard I/O descriptor attack?
1.8 Can I alter lsof's make(1) behavior?
1.9 Is there an lsof license?
1.10 Language locale support
1.10.1 Does lsof support language locales? How do I use the support?
1.10.2 Does lsof support wide characters in language locales?
1.11 Are any files in the lsof distribution copyrighted?
1.12 Are there other lsof-related resources?
1.13 What does the "WARNING: unsupported dialect or version" mean?
2.0 Lsof Ports
2.1 What ports exist?
2.2 What about a new port?
2.2.1 User-contributed Ports
2.3 Why isn't there an AT&T SVR4 port?
2.4 Why isn't there an SGI IRIX port?
2.5 Why does lsof's Configure script report "WARNING: unsupported
dialect or version"?
3.0 Lsof Problems
3.1 Configuration Problems
3.1.1 Why can't Configure determine the UNIX dialect version?
3.2 Compilation Problems
3.2.1 Why does the compiler complain about missing header files?
3.2.2 Why does gcc complain about the contents of header files
distributed by the system's vendor?
3.2.3 Other header file problems
3.3 Why doesn't lsof report full path names?
3.3.1 Why do lsof -r reports show different path names?
3.3.2 Why does lsof report the wrong path names?
3.3.3 Why doesn't lsof report path names for unlinked (rm'd) files?
3.3.4 Why doesn't lsof report the "correct" hard linked file path
name?
3.3.5 When will lsof report path names for deleted files?
3.4 Why is lsof so slow?
3.5 Why doesn't lsof's setgid or setuid permission work?
3.6 Does lsof have security problems?
3.7 Will lsof show remote hosts using files via NFS?
3.8 Why doesn't lsof report locks held on NFS files?
3.8.1 Why does lsof report a one byte lock on byte zero as a full
file lock?
3.9 Why does lsof report different values for open files on the
same file system (the automounter phenomenon)?
3.10 Why don't lsof and netstat output match?
3.10.1 Why can't lsof find accesses to some TCP and UDP ports?
3.11 Why does lsof update the device cache file?
3.12 Why doesn't lsof report state for UDP socket files?
3.13 I am editing a file with vi; why doesn't lsof find the file?
3.14 Why doesn't lsof report TCP/TPI window and queue sizes for my
dialect?
3.14.1 Why doesn't lsof report socket options, socket states, and TCP
flags and values for my dialect?
3.14.2 Why doesn't lsof report the partial listen queue connection
count for my dialect?
3.15 What does "no more information" in the NAME column mean?
3.16 Why doesn't lsof find a process that ps finds?
3.17 Why doesn't -V report a search failure?
3.18 Portmap problems
3.18.1 Why isn't a name displayed for the portmap registration?
3.18.2 How can I display only portmap registrations?
3.18.3 Why doesn't lsof report portmap registrations for some ports?
3.18.4 Why doesn't lsof report portmap registrations for some Solaris
versions?
3.19 Why is `lsof | wc` bigger than my system's open file limit?
3.20 Why doesn't lsof report file offset (position)?
3.20.1 What does lsof report for size when the file doesn't really have
one?
3.21 Problems with path name arguments
3.21.1 How do I ask lsof to search a file system?
3.21.2 Why doesn't lsof find all the open files in a file system?
3.21.3 Why does the lsof exit code report it didn't find open files
when some files were listed?
3.21.4 Why won't lsof find all the open files in a directory?
3.21.5 Why are the +D and +d options so slow?
3.21.6 Why do the +D and +d options produce warning messages?
3.22 Why can't my C compiler find the rpcent structure definition?
3.23 Why doesn't lsof report fully on file "foo" on UNIX dialect
"bar?"
3.24 Why do I get a complaint when I execute lsof that some library
file can't be found?
3.25 Why does lsof complain it can't open files?
3.26 Why does lsof warn "compiled for x ... y; this is z."?
3.27 How can I disable the kernel identity check?
3.28 Why don't ps(1) and lsof agree on the owner of a process?
3.29 Why doesn't lsof find an open socket file whose connection
state is past CLOSE_WAIT?
3.30 Why don't machine.h definitions work when the surrounding
comments are removed?
3.31 What do "can't read inpcb at 0x...", "no protocol control
block", "no PCB, CANTSENDMORE, CANTRCVMORE", etc. mean?
3.32 What do the "unknown file system type" warnings mean?
3.33 Installation
3.33.1 How do I install lsof?
3.33.2 How do I install a common lsof when I have machines that
need differently constructed lsof binaries?
3.34 Why do lsof 4.53 and above reject device cache files built
by earlier lsof revisions?
3.35 What do "like block special" and "like character special" mean
in the NAME column?
3.36 Why does an lsof make fail because of undefined symbols?
3.37 Command Regular Expressions (REs)
3.37.1 What are basic and extended regular expressions?
3.37.2 Why can't I put a slash in a command regular expression?
3.37.3 Why does lsof say my command regular expression wasn't found?
3.38 Why doesn't lsof report on shared memory segments?
3.39 Why does lsof report two instances of itself?
3.40 Why does lsof report '\n' in device cache file error messages?
3.41 Kernel Symbol and Address Problems
3.41.1 What does "lsof: WARNING: name cache hash size length error: 0"
mean?
3.41.2 Why does lsof produce "garbage" output?
3.42 Why does lsof report open files when run as super user that
it doesn't report when run with lesser privileges?
3.43 Test Suite Problems
3.43.1 Errors all tests can report:
3.43.1.1 Why do tests complain "ERROR!!! can't execute ../lsof"?
3.43.1.2 Why do tests complain "ERROR!!! can't find ..." a file?
3.43.1.3 Why do some tests fail to compile?
3.43.1.4 Why do some tests always fail?
3.43.1.5 Why does the test suite say it hasn't been validated on
my dialect?
3.43.1.6 Why do the tests complain they can't stat() or open()
/dev/mem or /dev/kmem?
3.43.2 LTbigf test issues
3.43.2.1 Why does the LTbigf test say that the dialect doesn't
support large files?
3.43.2.2 Why does LTbigf complain about operations on its config.LTbigf*
file?
3.43.2.3 Why does LTbigf warn that lsof doesn't return file offsets?
3.43.3 Why does the LTbasic test complain "ERROR!!! lsof this ..."
and "ERROR!!! lsof that ..."?
3.43.4 LTnfs test issues
3.43.4.1 Why does the LTnfs test complain "couldn't find NFS file ..."?
3.43.5 LTnlink test issues
3.43.5.1 Why does the LTnlink test complain that its test file is on
an NFS file system?
3.43.5.2 Why does LTnlink delay and report "waiting for link count
update: ..."?
3.43.5.3 Why does LTnlink fail because of an unlink error?
3.43.6 LTdnlc test issues
3.43.6.1 Why won't the LTdnlc test run?
3.43.6.2 What does the LTdnlc test mean by "... <path> found: 100.00%"?
3.43.6.3 Why does the DNLC test fail?
3.43.7 Why hasn't the test suite been qualified for 64 bit HP-UX
11 when lsof is compiled with gcc?
3.43.8 LTszoff test issues
3.43.8.1 Why does LTszoff warn that lsof doesn't return file offsets?
3.43.9 LTlock test issues
3.44 File descriptor list (the ``-d'' option) problems
3.44.1 Why does lsof reject a ``-d'' FD list?
3.44.2 Why are file descriptors other than those in my FD list
reported?
3.45 How can I supply device numbers for inaccessible NFS file
systems?
3.46 Why won't lsof find open files on over-mounted file systems?
3.47 What can be done when lsof reports no more space?
3.48 What if the lsof build encounters ar and ld problems?
3.49 Why does lsof -i report an open socket file for a process, but
lsof -p on that process' ID report nothing?
4.0 AIX Problems
4.1 What is the Stale Segment ID bug and why is -X needed?
4.1.1 Stale Segment ID APAR
4.2 Gcc Work-around for AIX 4.1x
4.3 Gcc and AIX 4.2
4.4 Why won't lsof's Configure allow the use of gcc for AIX
below 4.1?
4.5 What is an AIX SMT file type?
4.6 Why does AIX lsof start so slowly?
4.7 Why does exec complain it can't find libc.a[shr.o]?
4.8 What does lsof mean when it says, "TCP no PCB, CANTSENDMORE,
CANTRCVMORE" in a socket file's NAME column?
4.9 When the -X option is used on AIX 4.3.3, why does lsof disable
it, saying "WARNING: user struct mismatch; -X option disabled?"
4.10 Why doesn't the -X option work on my AIX 5L or 5.[123] system?
4.11 Why doesn't /usr/bin/oslevel report the correct AIX version?
4.11.1 Why doesn't /usr/bin/oslevel report the correct AIX version
on AIX 5.1?
4.12 Why does lsof for AIX 5.1 or above Power architecture
complain about kernel bit size?
4.13 What can't gcc be used to compile lsof on the ia64 architecture
for AIX 5 and above?
4.14 Why does lsof get a segmentation fault when compiled with gcc
for a 64 bit Power architecture AIX 5.1 kernel?
4.15 Why does lsof ignore AFS on my AIX system?
4.16 Why does lsof report "system paging space is low" and exit?
4.17 Why does lsof have compilation and execution problems on AIX
5.3 above maintenance level 1?
5.0 Apple Darwin Problems
5.1 What do /dev/kmem-based and libproc-based mean?
5.2 /dev/kmem-based Apple Darwin Questions
5.2.1 Why does Configure ask for a path to the Darwin XNU kernel
header files?
5.2.1.1 Why does Configure complain that Darwin XNU kernel header
files are missing?
5.2.2 Why doesn't Apple Darwin lsof report text file information?
5.2.3 Why doesn't Apple Darwin lsof support IPv6?
5.2.4 Why does lsof complain about a mismatch between the release
for which lsof was compiled and the booted Mac OS X release?
5.2.5 Why does lsof for Apple Darwin 8 and higher report
"stat(...): ..." in the NAME column?
5.2.6 What are the limitations of Apple Darwin lsof link count
reporting?
5.2.7 Why does Apple Darwin report process group IDs incorrectly?"ayy
5.3 Libproc-based Apple Darwin Questions
6.0 BSD/OS BSDI Problems
6.0.5 Statement of deprecation
8.0 FreeBSD Problems
8.1 Why doesn't lsof report on open kernfs files?
8.2 Why doesn't lsof work on my FreeBSD system?
8.3 Why doesn't lsof work on the RELEASE version of CURRENT?
8.4 Why can't kvm_open() can't find some file?
8.5 FreeBSD ZFS Problems
8.5.1 Why does FreeBSD lsof report "WARNING: no ZFS support has been
8.6 Why can't Configure create lsof_owner.h for FreeBSD 6 and above?
8.6.1 Why are there lockf structure compiler errors for FreeBSD 6.0
and higher lsof?
8.6.2 Why don't /usr/src/sys/sys/lockf.h and /usr/include/sys/lockf.h
match?
8.7 FreeBSD and clang
8.7.1 Why does clang complain about VOP_FSYNC?
9.0 HP-UX Problems
9.1 What do /dev/kmem-based and PSTAT-based mean?
9.2 /dev/kmem-based HP-UX lsof Questions
9.2.1 Why doesn't a /dev/kmem-based HP-UX lsof compilation use -O?
9.2.2 Why doesn't the /dev/kmem-based CCITT support work under 10.x?
9.2.3 Why can't /dev/kmem-based lsof be compiled with `cc -Aa` or
`gcc -ansi` under HP-UX 10.x?
9.2.4 Why does /dev/kmem-based lsof complain about no C compiler?
9.2.5 Why does Configure complain about q4 for /dev/kmem-based lsof
for HP-UX 11?
9.2.6 When compiling /dev/kmem-based lsof for HP-UX 11 what do the
"aCC runtime: ERROR..." messages mean?
9.2.7 Why doesn't /dev/kmem-based lsof for HP-UX 11 report VxFS file
link counts, node numbers, and sizes correctly?
9.2.8 Why can't /dev/kmem-based lsof be built with gcc for 64 bit
HP-UX 11?
9.2.8.1 How can I acquire a gcc for building lsof for 64 bit HP-UX 11?
9.2.9 Why does /dev/kmem-based lsof for HP-UX 11 report "unknown file
system type" for VxFS files?
9.2.10 Why does the ANSI-C compiler complain about comments in HP-UX
11 header files?
9.2.11 Why does dnode1.c cause the HP-UX 11 compiler to complain that
<sys/fs/vx_inode.h> is missing or incorrect?
9.3 PSTAT-based HP-UX lsof Questions
9.3.1 Why does PSTAT-based lsof complain about pst_static and
other PSTAT structures?
9.3.2 Why does PSTAT-based lsof complain it can't read pst_*
structures?
9.3.3 Why does PSTAT-based lsof rebuild the device cache file
after each reboot?
9.3.4 Why doesn't PSTAT-based lsof report TCP addresses for
telnetd's open socket files?
9.3.5 Why does PSTAT-based lsof cause an HP-UX 11.11 kernel panic?
9.3.6 Why doesn't PSTAT-based lsof report a CWD that is on a loopback
(LOFS) file system?
9.3.7 Why do some swinstall packages for PSTAT-based HP-UX 11.11
packages complain about setgid and setuid bits?
9.3.8 Why won't the bundled C compiler build PSTAT-based lsof for
PA-RISC HP-UX 11.23?
9.3.9 Why won't gcc build PSTAT-based lsof for PA-RISC HP-UX 11.23?
9.3.10 Why does PSTAT-based lsof complain, "FATAL: pst_stream_size
should be: 672; is 72" on HP-UX 11.11 and above?
9.4 Why won't the HP-UX depot install?
10.0 Linux Problems
10.1 What do /dev/kmem-based and /proc-based lsof mean?
10.2 /proc-based Linux lsof Questions
10.2.1 Why doesn't /proc-based lsof report file offsets (positions)?
10.2.2 Why does /proc-based lsof report "can't identify protocol" for
some socket files?
10.2.3 Why does /proc-based lsof warn about unsupported formats?
10.2.4 Why does /proc-based lsof report "(deleted)" after a path name?
10.2.5 Why doesn't /proc-based lsof report full open file information
for all processes?
10.2.6 Why won't Customize offer to change HASDCACHE or WARNDEVACCESS
for /proc-based lsof?
10.2.7 /proc-based lsof Linux NFS questions
10.2.7.1 Why can't lsof find files on an accessible NFS file system?
10.2.7.2 Why can't lsof find files on an inaccessible NFS file system?
10.2.8 Why doesn't /proc-based Linux lsof report socket options and
values, socket state flags, and TCP options and values?
10.2.9 Does /proc-based Linux lsof use a device cache?
10.2.10 Why doesn't /proc-based Linux lsof report any or all file structure
values for its +fcfgGn option?
10.3 Special Linux file types
10.3.1 Why is ``DEL'' reported as a Linux file type?
10.3.2 Why is ``unknown'' reported as a Linux file type?
10.4 Linux ``mem'' Entry Problems
10.4.1 What do ``path dev=xxx'' and ``path inode=yyy'' mean in the
NAME column of Linux ``mem'' file types?
10.4.2 Why is neither link count nor size reported for some Linux
``DEL'' and ``mem'' file types?
10.5 Special Linux NAME column messages
10.5.1 What does ``(stat: xxx)'' mean in the NAME column of Linux
files?
10.5.2 What does ``(readlink: xxx)'' mean in the NAME column of
Linux files?
10.6 Why is ``NOFD'' reported as a Linux file type?
10.7 Why does Linux lsof report a NAME column value that begins with
``/proc''?
10.8 Linux /proc/net/tcp* and /proc/net/udp* issues
10.8.1 Why use the Linux -X option?
10.8.2 Why does lsof say ``-i is useless when -X is specified''?
10.8.3 Why does lsof say ``can't identify protocol (-X specified)''?
11.0 NetBSD Problems
11.1 Why doesn't lsof report on open kernfs files?
11.2 Why doesn't lsof report on open files on: file descriptor
file systems; /proc file systems; 9660 (CD-ROM) file systems;
MS-DOS (floppy disk) file systems; or kernel file systems?
11.3 Why does lsof produce confusing results for nullfs file
systems?
11.4 NetBSD header file problems
11.4.1 Why can't the compiler find some NetBSD header files?
11.4.2 Why does NetBSD lsof produce incorrect output?
11.5 Why isn't lsof feature xxx enabled for NetBSD?
13.0 OpenBSD Problems
13.1 Why doesn't lsof support kernfs on my OpenBSD system?
13.2 Will lsof work on OpenBSD on non-x86-based architectures?
13.3 <sys/pipe.h> problems
13.3.1 Why does the compiler claim nbpg isn't defined?
13.3.2 What value should I assign to nbpg?
13.4 Why doesn't lsof report on open MS-DOS file system (floppy
disk) files?
13.5 Why isn't lsof feature xxx enabled for OpenBSD?
14.0 Output problems
14.1 Why do the lsof column sizes change?
14.2 Why does the offset have ``0t' and ``0x'' prefixes?
14.3 What are the values printed in the FILE_FLAG column
and why is 0x<value> sometimes included?
14.3.1 Why doesn't lsof display FILE_FLAG values for my dialect?
14.4 Network Addresses
14.4.1 Why does lsof's -n option cause IPv4 addresses, mapped to
IPv6, to be displayed in IPv6 notation?
14.5 Why does lsof output \x, ^x, or \xnn for characters
sometimes?
14.5.1 Why is space considered a non-printable character in command
names?
14.6 Why doesn't lsof print all the characters of a command name?
14.7 Why does lsof reject some -c command names, saying their lengths
are "> what system provides (nn)"?
14.8 Why does lsof sometimes print TYPE numbers instead of names?
14.9 Marker line format problems
14.9.1 Why won't lsof accept a marker line format?
14.9.2 Why does lsof reject the NL (%n) marker line format?
14.10 How are protocol state name exclusion and inclusion used?
14.10.1 Why doesn't my dialect support state name exclusion and inclusion?
15.0 Pyramid Version Problems
15.0.5 Statement of deprecation
16.0 SCO Problems
16.1 SCO OpenServer Problems
16.1.1 How can I avoid segmentation faults when compiling lsof?
16.1.2 Where is libsocket.a?
16.1.3 Why do I get "warning C4200" messages when I compile lsof?
16.2 SCO|Caldera UnixWare Problems
16.2.1 Why doesn't lsof compile on my UnixWare 7.1.1 or above
system?
16.2.2 Why does lsof complain about node_self() on my UnixWare
7.1.1 or above system?
16.2.3 Why does UnixWare 7.1.1 or above complain about -lcluster,
node_self(), or libcluster.so?
16.2.4 Why does UnixWare 7.1.1 or above lsof complain it can't
read the kernel name list?
16.2.5 Why doesn't lsof report link count, node number, and size
for some UnixWare 7.1.1 or above CFS files?
16.2.6 Why doesn't lsof report open files on all UnixWare 7.1.1
NonStop Cluster (NSC) nodes?
16.2.7 Why doesn't lsof report the UnixWare 7.1.1 NonStop Cluster
(NSC) node a process is using?
16.2.8 Why does the compiler complain about missing UnixWare 2.1[.x]
header files?
17.0 Sun Problems
17.0.5 Statement of deprecation
17.1 My Sun gcc-compiled lsof doesn't work -- why?
17.2 How can I make lsof compile with gcc under Solaris 2.[456],
2.5.1, 7, 8 or 9?
17.3 Why does Solaris Sun C complain about system header files?
17.4 Why doesn't lsof work under my Solaris 2.4 system?
17.5 Where are the Solaris header files?
17.6 Where is the Solaris /usr/src/uts/<architecture>/sys/machparam.h?
17.7 Why does Solaris lsof say ``can't read proc table''?
17.8 Why does Solaris lsof complain about a bad cached clone device?
17.9 Why doesn't Solaris make generate .o files?
17.10 Why does lsof report some Solaris 2.3 and 2.4 lock types as `N'?
17.11 Why does lsof Configure say "WARNING: no cc in ..."?
17.12 Solaris 7, 8 and 9 Problems
17.12.1 Why does lsof say the compiler isn't adequate for Solaris
7, 8 or 9?
17.12.2 Why does Solaris 7, 8 or 9 lsof say "FATAL: lsof was compiled
for..."?
17.12.3 How do I build lsof for a 64 bit Solaris kernel under a 32
bit Solaris kernel?
17.12.4 How do I install lsof for Solaris 7, 8 or 9?
17.12.5 Why does my Solaris 7, 8 or 9 system say it cannot execute
lsof?
17.12.6 What gcc will produce 64 bit Solaris 7, 8 and 9 executables?
17.12.7 Why does lsof on my Solaris 7, 8 or 9 system say, "can't
read namelist from /dev/ksyms?"
17.13 Solaris and COMMON
17.13.1 What does COMMON mean in the NAME column for a Solaris VCHR
file?
17.13.2 Why does a COMMON Solaris VCHR file sometimes seem to have an
incorrect minor device number?
17.14 Why don't lsof and Solaris pfiles reports always match?
17.15 Why does lsof say, "kvm_open(namelist=default, core=default):
Permission denied?"
17.16 Why is lsof slow on my busy Solaris UFS file system?
17.17 Why is lsof so slow on my Solaris 8 or 9 system?
17.18 Solaris and VxFS
17.18.1 Why doesn't lsof support VxFS 3.4 on Solaris 2.6, and above?
17.18.2 Why does lsof report "vx_inode: vxfsu_get_ioffsets error"
for open Solaris 2.6 and above VxFS 3.4 and above files?
17.18.3 Why does Solaris Configure claim there is no VxFS library?
17.18.4 Why doesn't Solaris lsof report VxFS path name components?
17.18.5 Why does Solaris 10 lsof report scrambled VxFS paths?
17.19 Large file problems
17.19.1 Why does lsof complain it can't stat(2) a Solaris 2.5.1
large file?
17.20 Why does lsof get a segmentation fault on 64 bit Solaris
8 using NIS+?
17.21 Will lsof crash the Solaris kernel?
17.22 Why does lsof on Solaris 7, 8, or 9 report a kvm_open()
failure?
17.23 Solaris and SAM-FS
17.23.1 Why does Solaris lsof report "(limited SAM-FS info)"?
17.23.2 Why can't lsof locate named SAM-FS files?
17.24 Lsof and Solaris 10 zones
17.24.1 How can I make lsof list the Solaris zone?
17.24.2 Why doesn't lsof work in a Solaris 10 zone?
17.24.3 Why does lsof complain it can't stat() Solaris 10 zone file
systems?
17.25 Solaris 10 problems
17.25.1 Why does Solaris 10 lsof sometimes report the wrong path name?
17.25.2 Why does Solaris 10 lsof sometimes report only the mounted-on
directory and device?
17.25.3 What does "(deleted)" mean in the NAME column of a Solaris 10
open file?
17.25.4 What does "(?)" mean in the NAME column of a Solaris 10 open
file?
17.26 Solaris contract file problems
17.26.1 Why doesn't lsof report size, link count and node number for
Solaris 10 contract files?
17.26.2 Why can't lsof locate a Solaris 10 contract file by path name?
17.27 Solaris 10 and above ZFS problems
17.27.1 Why does Configure warn that ZFS support is not enabled?
17.28 Problems with Solaris 9 and above
17.28.1 Why does the compiler complain about lgrp_root on Solaris 9
and above?
18.0 Lsof Features
18.1 Why doesn't lsof doesn't report on /proc entries on my
system?
18.2 How do I disable the device cache file feature or alter
its behavior?
18.2.1 What's the risk with a perverted device cache file?
18.2.2 How do I put the full host name in a personal device cache file
path?
18.2.3 How do I put the personal device cache file in /tmp?
18.3 Why doesn't lsof know about AFS files on my favorite dialect?
18.3.1 Why doesn't lsof report node numbers for all AFS volume files,
or how do I reveal dynamic module addresses to lsof?
______________________________________________________________________
1.0 General Concepts
1.1 Lsof -- what is it?
Lsof is a UNIX-specific tool. Its name stands for LiSt
Open Files, and it does just that. It lists information
about files that are open by the processes running on a
UNIX system.
See the lsof man page, the 00DIST file, the 00QUICKSTART
file, and the 00README file of the lsof distribution for
more information.
1.2 Where do I get lsof?
Lsof is available via anonymous ftp from lsof.itap.purdue.edu.
Look in the pub/tools/unix/lsof sub-directory.
ftp://lsof.itap.purdue.edu/pub/tools/unix/lsof
Bzip2'd, compressed and gzip'd tar files with GPG certificates
are available.
1.2.1 Are there mirror sites?
On March 21, 2013 these sites appeared to have the latest
lsof revision:
ftp://ftp.fu-berlin.de/pub/unix/tools/lsof
ftp://sunsite.ualberta.ca/pub/Mirror/lsof
http://www.mirrorservice.org/sites/lsof.itap.purdue.edu/pub/tools/unix/lsof/
ftp://ftp.mirrorservice.org/sites/lsof.itap.purdue.edu/pub/tools/unix/lsof/
rsync://rsync.mirrorservice.org/lsof.itap.purdue.edu/pub/tools/unix/lsof/
1.2.2 Are lsof executables available?
Some lsof executables are available in the subdirectory
tree pub/tools/unix/lsof/binaries These are neither guaranteed
to be current nor cover every dialect and machine architecture.
I don't recommend you use pre-compiled lsof binaries; I
recommend you obtain the sources and build your own binary.
Even if you're a Sun user without a Sun C compiler, you
can use gcc to compile lsof.
If you must use a binary file, please be conscious of the
security and configuration implications in using an executable
of unknown or different origin. The lsof binaries are
accompanied by GPG certificates. Please use them!
Three additional cautions apply to executables:
1. Don't try to use an lsof executable, compiled for one
version of a UNIX dialect, on another. Patches can
make the dialect version different.
2. If you want to use an lsof binary on multiple systems,
they must be running the same dialect OS version and
have the same patches and feature support.
1.2.3 How do I check the validity of an lsof distribution?
There are two ways to check the validity of an lsof
distribution:
1. Follow the instructions in the CHECKSUMS_<revision>
file found with the lsof distribution.
Checking with GPG is the best method.
2. Follow the instructions in the "Security" section of the
README.lsof_<revision> file found inside the lsof
distribution.
Again, checking with GPG is the best method.
1.2.4 Why can't I get the sum(1) result reported in
README.lsof_<revision>?
The "Security" section of the README.lsof_<revision> file found
inside the lsof distribution gives md5, sum, and GPG certificate
information.
The simplest, the sum(1) signature, seems to be the trickiest.
That's because there are different sum(1) methods, BSD systems
usually have cksum(1) instead of sum(1), and different systems
compute the block size value differently.
First, the lsof sum results are computed with the old,
"alternate" algorithm. On newer systems, you can use sum's
"-r" option to get that computation result.
Second, on BSD systems you usually must use cksum(1) instead
of sum(1), because they have no sum(1). To tell cksum(1)
to use the old, "alternate" algorithm, use its "-o1" option.
Third, the second value that sum reports, the block count, may
be computed differently on different systems -- usually block
size is considered to be 512 or 1,024. The lsof block counts
were computed on a system with a sum(1) option that considers
block size to be 512. The BSD system cksum(1) -o1 option
considers block size to be 1,024. If your sum(1) or cksum(1)
doesn't report a block count that matches the sum(1) signature
given in README.lsof_<revision>, check its man page to see what
block size it uses, then adjust its reported block count
appropriately.
1.2.5 Why won't gpg accept the lsof-signing PGP public key?
An older PGP key that once signed lsof distributions is
included in lsof revisions prior to 4.70. The PGP key is
indeed my key, but is incompatible with GPG. It was created
about ten years ago and is still acceptable to PGP versions
2.6.2 through 6.5.2.
Lsof revisions 4.70 and above are signed with a copy of my PGP
key that has been made acceptable for use with GPG by importing
it under GPG's "--allow-non-selfsigned-uid" option.
You can find my GPG compatible key in lsof revisions 4.70 and
above and at:
ftp://lsof.itap.purdue.edu/pub/Victor_A_Abell.gpg
If you have an older lsof revision with my PGP key, there are
two possible ways to use it:
* Use it with a PGP version from 2.6.2 through 6.5.2.
* Use GPG's "--allow-non-selfsigned-uid" option when you
import my PGP key into your GPG key ring.
$ gpg --allow-non-selfsigned-uid --import Victor_A_Abell.pgp
1.3 Where can I get more lsof documentation?
A significant set of documentation may be found in the lsof
distribution (See "Where can I get lsof?). There is a
manual page, copious documentation in files whose names
begin with 00, and a copy of this FAQ in the file 00FAQ
(perhaps slightly less recent than this file if you're
reading it via a web browser.)
Two URLs provide some documentation that appears in the
lsof distribution:
FAQ: ftp://lsof.itap.purdue.edu/pub/tools/unix/lsof/FAQ
man page: ftp://lsof.itap.purdue.edu/pub/tools/unix/lsof/lsof_man
1.4 How do I report an lsof bug?
If you believe you have discovered a bug in lsof, you can report it to
https://github.com/lsof-org/lsof. Do NOT report lsof bugs to the UNIX
dialect vendor.
Before you send a bug report, please read the "Bug Reports" section of
the 00README file of the lsof distribution. It lists the steps you
should take before and when reporting a suspected bug.
1.5 Where can I get the lsof FAQ?
This lsof FAQ is available in the file 00FAQ in the lsof
distribution and at the URL:
ftp://lsof.itap.purdue.edu/pub/tools/unix/lsof/FAQ
1.5.1 How timely is the on-line FAQ?
The on-line FAQ is sometimes too timely. :-)
I update it as soon as new information is available. That may
include information about support that won't appear in the lsof
source distribution until the next revision. If you encounter
something like that, please send me e-mail at <abe@purdue.edu>. I
may be able to point you at a pre-release distribution that contains
the support of interest. Make sure "lsof" appears in the "Subject:"
line so my e-mail filter won't classify your letter as Spam.
1.6 Is there a test suite?
Yes, as of lsof revision 4.63 there's an automated lsof
test suite in the tests/ sub-directory of the lsof top-level
directory.
More information on using the test suite, what it does,
how to use it and how to configure it may be found in the
00TEST file of the lsof distribution. That file also
explains where the test suite has been tested.
Frequently asked questions about the test suite will be
asked and answered here in the FAQ. (See "Test Suite
Problems.")
After lsof has been configured with the Configure script,
lsof can be made and tested with:
$ make
$ cd tests
$ make
Under normal conditions -- i.e., unless the lsof tree has
been cleaned or purged severely -- all tests or individual
tests may be run by:
$ cd test
$ make
or
$ <run a single test> (See 00TEST.)
1.7 Is lsof vulnerable to the standard I/O descriptor attack?
Lsof revisions 4.63 and above are not vulnerable.
Lsof revisions 4.62 and below are vulnerable, but no damage
scenarios have so far been demonstrated.
The standard I/O descriptor attack is a local programmed
assault on setuid and setgid programs that tricks them into
opening a sensitive file with write access on a standard
descriptor, usually stderr (2), and writing error messages
to stderr. If the attacker can control the content of the
error message, the attacker may gain elevated privileges.
The attack was first described in Pine Internet Advisory
PINE-CERT-20020401, available at:
http://www.pine.nl/advisories/pine-cert-20020401.txt
If you are using an lsof revision below 4.63, you should
remove any setuid or setgid permissions you might have
given its executable. Then you should upgrade to lsof
revision 4.63.
1.8 Can I alter lsof's make(1) behavior?
Yes. There are at least two ways to do that.
You can put replacements for lsof Makefile strings in your
environment. If you specify the -e make option, make will
give environment variable values precedence over strings
from the Makefile. For example, to change the compiler
string CC from the environment, you might do this with the
Bourne shell:
$ CC=foobar; export CC
$ make -e
You can also replace lsof Makefile strings in the make
command invocation. Here's the previous example done that
way:
$ make CC=foobar
Changing the CFGF, CFGL, and DEBUG strings used in lsof
Makefiles, either from the environment or from the make
invocation, can significantly alter lsof make(1) behavior.
I commonly use DEBUG to change the -O option to -g so I
can build an lsof executable for debugging -- e.g.,
$ make DEBUG=-g
(Look for DEBUG in this FAQ for other examples of its use.)
Consult the Makefiles to see what CFGL, CFGL, and other
lsof Makefile strings contain, and to see what influence
their alteration might have on lsof make(1) behavior.
1.9 Is there an lsof license?
No.
The only restriction on the use or redistribution of lsof
is contained in this copyright statement, found in every
lsof source file. (The copyright year in or format of the
notice may vary slightly.)
/*
* Copyright 2002 Purdue Research Foundation, West Lafayette,
* Indiana 47907. All rights reserved.
*
* Written by Victor A. Abell
*
* This software is not subject to any license of the American
* Telephone and Telegraph Company or the Regents of the
* University of California.
*
* Permission is granted to anyone to use this software for
* any purpose on any computer system, and to alter it and
* redistribute it freely, subject to the following
* restrictions:
*
* 1. Neither the authors nor Purdue University are responsible
* for any consequences of the use of this software.
*
* 2. The origin of this software must not be misrepresented,
* either by explicit claim or by omission. Credit to the
* authors and Purdue University must appear in documentation
* and sources.
*
* 3. Altered versions must be plainly marked as such, and must
* not be misrepresented as being the original software.
*
* 4. This notice may not be removed or altered.
*/
1.10 Language locale support
1.10.1 Does lsof support language locales? How do I use the support?
Most UNIX dialect versions of lsof support 8 bit language
locale characters -- e.g., the ability to print 8 bit
characters that have accents and other marks over them.
See the answer to the "Does lsof support wide characters in
language locales?" question for information on when lsof's
language locale support covers characters wider than 8 bits.
To see if lsof supports language locales for your dialect, look
in the dialect's machine.h header file for the HASSETLOCALE
definition. If it is present and not disabled, then lsof has
language locale support for the dialect.
To enable lsof's language locale support, you must specify in a
locale environment variable (e.g., LANG) a language locale
known to your system that supports the printing of marked
characters -- e.g, en_US. (On some dialects locale(1) may be
used to list the known language locales.)
Note that LANG=C and LANG=POSIX are NOT language locales that
support the printing of marked characters.
If the language locale doesn't support the printing of marked
characters, lsof's OUTPUT of them follows the rules for
non-printable characters described in the OUTPUT section of
lsof(8).
Consult your dialect's setlocale(3) man page for the names of
environment variables other than LANG -- e.g., LC_ALL,
LC_TYPE, etc. -- which may be used to define language locales.
1.10.2 Does lsof support wide characters in language locales?
When lsof's language locale support is enabled with the
HASSETLOCALE definition, for selected dialects lsof will also
print wide characters (e.g., from UTF-8) when iswprint(3)
reports them to be printable.
Wide character support is available when HASWIDECHAR is defined
in a dialect's machine.h header file. As of this writing on
July 22, 2004, the following dialect versions have wide character
support:
AIX >= 4.3.2
Apple Darwin >= 7.3.0
FreeBSD >= 5.2
HP-UX >= 11.00
/proc-based Linux
NetBSD >= 1.6
SCO OpenServer >= 5.0.6
Solaris >= 2.6
Tru64 UNIX 5.1
1.11 Are any files in the lsof distribution copyrighted?
Yes. Most files carry the copyright of the Purdue Research
Foundation and may be redistributed under the terms that
accompany the copyright notice. Those terms may also be found
in the answer to the question, "Is there an lsof license?")
A few files carry other copyright notices. Some are BSD
notices and they explain the terms under which they are
included in the lsof distribution.
Those that carry vendor copyright notices have been reproduced
in their original or modified forms with permission from the
copyright owners. That permission is indicated in the README
files that accompany the files.
1.12 Are there other lsof-related resources?
There are other resources available, connected to lsof. Among
them are FreeBSD and Linux packages whose products use lsof and
two particularly interesting resources.
The two interesting resources are a Gnome Tool Kit (GTK) GUI
for lsof and a Perl wrapper module.
The GTK GUI is called Glsof and was developed by Gnele. It can
be found at:
http://www.sourceforge.net
The Perl wrapper module by Marc Beyer can be found at:
http://search.cpan.org/dist/Unix-Lsof/
1.13 What does the "WARNING: unsupported dialect or version" mean?
The lsof configure script issues that message for UNIX dialects
or their versions where I have been unable to test the current
revision of lsof. The message doesn't mean that lsof won't
work, just that I have no direct evidence that it will.
If the COnfigure script succeeds, except for the warning, try
compiling) lsof. If that succeeds, try the lsof test suite.
2.0 Lsof Ports
2.1 What ports exist?
The pub/lsof.README file carries the latest port information:
AIX 5.[23] and 5.3
FreeBSD 4.9 and 6.4 for x86-based systems
FreeBSD 8.[234], 9.0, 10.0 and 11.0 for AMD64-based systems
Linux 2.1.72 and above for x86-based systems
Solaris 9, 10 and 11
In the above list the only UNIX dialects present are ones for
which I test the current lsof revision. Lsof may still support
unlisted dialect versions -- e.g., HP-UX 10.20, Solaris 7, etc.
-- but I don't have access to systems where I could test lsof
on them, so I can't claim lsof works on them. If your dialect
isn't in the list, you should try building lsof on it anyway.
Lsof version 4 predecessors, versions 2 and 3, may support older
version of some dialects. Contact me via e-mail at <abe@purdue.edu>
if you're interested in their distributions. Make sure "lsof"
appears in the "Subject:" line so my e-mail filter won't classify
your letter as Spam.
2.2 What about a new port?
The 00PORTING file in the distribution gives hints on doing
a port. I will consider doing a port in exchange for
permanent access to a test host. I require permanent access
so I can test new lsof revisions, because I will not offer
distributions of dialect ports I cannot upgrade and test.
2.2.1 User-contributed Ports
Sometimes I receive contributions of ports of lsof to
systems where I can't test future revisions of lsof. Hence,
I don't incorporate these contributions into my lsof
distribution.
However, I do make descriptions of these contributions
available. You can find them in the 00INDEX and README
files at:
ftp://lsof.itap.purdue.edu/pub/tools/unix/lsof/contrib
Consult the 00INDEX file in the contrib/ directory for a
list of the available contributions and consult README
there for information on how to obtain them.
2.3 Why isn't there an AT&T SVR4 port?
I haven't produced an AT&T SVR4 port because I haven't seen
a UNIX dialect that is strictly limited to the AT&T System
V, Release 4 source code. Every one I have seen is a
derivative with vendor additions.
The vendor additions are significant to lsof because they
affect the internal kernel structures with which lsof does
business. While some vendor derivatives of SVR4 are similar,
each one I have encountered so far has been different enough
from its siblings to require special source code.
If you're interested in an SVR4 version of lsof, here are
some existing ports you might consider:
DC/OSx (This obsolete port is only available upon
special request.)
Reliant UNIX (This obsolete port is only available
upon special request.)
SCO|Caldera UnixWare (This is the most likely choice.)
Solaris
2.4 Why isn't there an SGI IRIX port?
Lsof support for IRIX was terminated at lsof revision 4.36,
because it had become increasingly difficult for me to
obtain information on the IRIX kernel structures lsof needs
to access.
At IRIX 6.5 I decided the obstacles were too large for me
to overcome, and I stopped supporting lsof on IRIX. I have
sources to the last revision of lsof (4.36) for IRIX, but
that version of lsof does not work on IRIX 6.5 and is
vulnerable to the standard I/O descriptor attack. (See