Alternatives for "lsof" command?

Question

In many cases lsof is not installed on the machines that I have to work with, but the "function" of lsof would be needed very much (for example on AIX). :\

Are there any lsof like applications in the non-Windows world?

For example, I need to know which processes use the /home/username directory?

Could you be more specific, please? What systems apart from AIX (which is definitely supported by lsof) do you have in mind? Or is there only one specific type of use of lsof you have in mind? Generally: why *not* lsof? — rozcietrzewiacz, Aug 12 '11 at 06:25
I'm using Linux 2.6.18-92.el5 GNU, and I don't have lsof, nor do I have the capability to use lsof :( — SSH This, Jan 11 '13 at 17:52
Related question: [how to check open file without lsof](https://stackoverflow.com/questions/10796298/how-to-check-open-file-without-lsof) — Stéphane Gourichon, Jun 27 '17 at 15:43

score 25 · Accepted Answer · edited Sep 07 '21 at 18:32

25

I know of fuser, see if it's available on your system.

edited Sep 07 '21 at 18:32

Matthias Braun

7,797
7
45
54

answered Aug 12 '11 at 06:40

enzotib

50,671
14
120
105

1

what do i have to give fuser as parameter to list all open files on a system? :O ty! – LanceBaynes Aug 12 '11 at 08:08
4

The command `sudo fuser -vm / 2>&1 | awk '$3 ~ /f|F/' | less` can show all processes having open files on the filesystem mounted on `/`. See man page for specific help. – enzotib Aug 12 '11 at 08:18
TY! it gives output like this: http://pastebin.com/raw.php?i=2z19g6Rk - i googled for it, but i can't find any way to output ex.: "gnome-screensaver", not "gnome-screensav" - so how can i output it with wide command names? :O – LanceBaynes Aug 12 '11 at 08:29
it gives the same output for: http://pastebin.com/raw.php?i=Fe3EJvUv – LanceBaynes Aug 12 '11 at 08:33
Something like this: `sudo fuser -vm / 2>&1 | awk '$3 ~ /f|F/' | while read user pid flags rest; do printf '%10s %10s %10s %s\n' $user $pid $flags "$( – enzotib Aug 12 '11 at 08:33
I would say `ps uww --pid $(fuser -vm / 2>&1 | awk '$3 ~ /[fF]/ { print $2 }') | less`. With a bit tweaking, you can get the file in front of it. – Lekensteyn Aug 12 '11 at 08:42
`fuser` is also unavailable for me. Got some results with `netstat -p -x` – Luc Dec 24 '13 at 18:45

score 16 · Answer 2 · edited Jun 05 '19 at 09:52

The Unix Rosetta Stone is a good resource for this kind of questions. It mentions a few alternatives for lsof (see below). Do note however that lsof is the de facto standard application for what it does.

If all you want is to find the process ID(s) that have a particular file open, then you can use fuser on any POSIX-compliant system.

On operating systems with a /proc directory, you can query the files open by a process (the reverse from lsof's most common mode of operation) through information in /proc. Some operating systems have commands for that:

AIX: procfiles is shipped with the system (since AIX 5.2). See also AIX 5.2 performance tools update and Usage and examples of lsof, pfiles, procfiles commands.
Solaris: pfiles (existing since 2.5).

jlliagre · Answer 3 · 2014-09-28T20:13:07.227

8

If you happen to run Solaris, an alternative to lsof, which isn't installed by default and might choke on ZFS, is pfiles.

eg:

pfiles /proc/*

edited Sep 28 '14 at 20:13

answered Aug 12 '11 at 08:38

jlliagre

60,319
10
115
157

score 4 · Answer 4 · answered Aug 26 '16 at 22:48

My version, with only a little less running of utilities:

for proc_pid in $(find /proc -maxdepth 1 -name "[0-9]*"); do \
    ls -l ${proc_pid}/fd 2>/dev/null \
    | grep -q "$search_term" \
    && echo "${proc_pid#/proc/}"; \
done

Admittedly, it may not handle all corner cases, but is working in my use-case.

score 0 · Answer 5 · answered Mar 03 '16 at 15:56

This should do the trick. It'll give the all the file descriptor mappings except those which:

you don't have permission to view, or
are for files which contain the string "Permission denied"

( find /proc -mindepth 1 -maxdepth 1 \
  | grep -E [0-9]+ | xargs -n 1 -I% find %/fd \
  | xargs ls -l \
  | grep -v "Permission denied" ) 2>/dev/null \
| cut -d' ' -f12- | less

If you already know you only care about the mappings for certain programs, you could instead use something more along the lines of:

exec=sshd
pgrep "$exec" | xargs -n 1 ps -p
pgrep "$exec" | xargs -n 1 -I% find /proc/%/fd | xargs ls -l | cut -d' ' -f12- | less

score -1 · Answer 6 · edited Jun 05 '19 at 07:52

-1

Sometimes lsof is installed in /usr/sbin

If /usr/sbin is not part of your $PATH, you could miss the command even installed.

Check it with

whereis lsof
lsof: /usr/sbin/lsof /usr/share/man/man8/lsof.8.gz

edited Jun 05 '19 at 07:52

Kevdog777

3,194
18
43
64

answered Jun 05 '19 at 07:34

Clement

47
4

The OP said that lsof was not installed and asked for alternatives... – Jeff Schaller Jun 05 '19 at 09:54
Great thanks. Found it. Earlier, I had searching in many paths including /usr/bin/ and never found. Your post definitely helped. And introduced to a new path! – user274900 Aug 17 '23 at 11:12

Alternatives for "lsof" command?

6 Answers6